• AI-assisted attack automation is accelerating the attacker’s operational scale
• Gaps related to identity and visibility persist in hybrid clouds
• The double/extortion attacks have increased their pressure on victims
• Attack vectors will keep growing due to third parties and SaaS
• There will be more connectivity in operational technology environments
• The use of AI presents additional visibility challenges

According to the results from IBM’s research entitled “Cost of a Data Breach Report 2025,” the global average cost of a data breach was around $4.4 million; however, companies employing substantial amounts of artificial intelligence and automation while handling data breaches managed to save about $1.9 million.¹

In the case of U.S. corporate executives, the threat of ransomware has transformed from an IT-related problem to a board-level issue of operational resilience.

The Industrialization of Cyber Extortion

Earlier ransomware attacks used to focus on securing the computer while demanding money for the decryption of information stored within the system. This approach has been completely revolutionized.

The new generation of ransomware groups acts like decentralized groups, maintaining affiliate systems, malware environment, access market, and extortion operations.

The ransomware operation of today increasingly emphasizes:

• Data exfiltration
• Public exposure threats
• Regulatory pressure
• Supply chain disruption
• Business interruption
• Executive targeting
• Cyber insurance exploitation
• Multi-stage extortion campaigns
• Destructive operational disruption

Deloitte’s Cyber Threat Trends Analysis highlighted that ransomware affiliates are increasingly leveraging AI-enabled social engineering, modular malware tooling, and decentralized affiliate ecosystems to accelerate attack execution and maximize extortion outcomes.²

There is also an increase in the resilience of threat actors. In case there is any disruption on the law enforcement side against the environment for ransomware, affiliates move their operations to other environments, and the business resumes almost effortlessly.

This agility ensures that ransomware will soon mature to become a crime economy capable of responding at the enterprise level.

AI Speeds Up the Cyber Threat Environment

AI technology is now quickly emerging as a multiplier effect in cyber extortion campaigns.

Accenture’s 2025 State of Cybersecurity Resilience report shows that only 10% of companies have what it takes to defend themselves against AI-powered attacks.³

Attackers are increasingly leveraging AI for:

• Automating phishing campaigns
• Impersonating using deepfakes
• Credential theft
• Malware modification
• Reconnaissance automation
• Social engineering optimization
• Rapid vulnerability exploitation
• Adaptive evasion techniques

IBM reporting additionally showed that 97% of organizations experiencing AI-related security incidents lacked proper AI access controls. ¹

For enterprise leaders, the implications are substantial.

AI-based attacks cut down operational expenses for attackers while improving the tempo and sophistication levels of attacks. In addition, today’s threat actors can launch very convincing phishing and impersonation attacks on thousands of employees, contractors, and partners very quickly.

There is a trend emerging as ransomware attacks get merged with AI, that the velocity of attacks will start to beat security response times.

This shift is especially dangerous for:

• Financial services
• Healthcare organizations
• Manufacturing enterprises
• Critical infrastructure operators
• Federal contractors
• Cloud-first enterprises
• AI-driven SaaS providers

Identity Security Has Become the Primary Battleground

Identity compromise is now central to ransomware execution.

Threat actors increasingly target:

• Privileged accounts
• VPN credentials
• Cloud identities
• Active Directory infrastructure
• SaaS authentication systems
• Third-party access providers
• Machine identities
• API authentication layers

Once the hackers gain access via identity, encryption usually follows as a second priority.

Today’s ransomware gangs value the quiet process of moving laterally and exfiltrating data prior to executing any encryption tasks.

Accenture research found that nearly two-thirds of organizations surveyed fell into what they described as the “Exposed Zone,” meaning they lack integrated cybersecurity strategies capable of protecting increasingly distributed digital ecosystems.

Organizations with fragmented identity environments face elevated risk across:

• Hybrid cloud infrastructure
• Remote workforce models
• DevOps pipelines
• AI environments
• SaaS ecosystems
• Operational technology environments

As ransomware groups continue targeting identity infrastructure, Zero Trust implementation is becoming a strategic resilience requirement rather than an optional modernization initiative.

The Financial Impact Continues to Escalate

Cyber extortion continues to generate significant financial damage for enterprises despite declining payment rates in some sectors.

The operational impact extends far beyond ransom payments themselves.

Enterprise organizations increasingly face secondary costs involving:

• Regulatory investigations
• SEC disclosure obligations
• Legal exposure
• Downtime losses
• Third-party liabilities
• Cyber insurance impacts
• Brand damage
• Customer attrition
• Shareholder scrutiny
• Recovery operations
• Forensic investigations

Public companies in the United States now face growing pressure associated with SEC cyber disclosure requirements, particularly when ransomware incidents materially affect operations, financial performance, or customer trust.

The financial implications are becoming especially severe for organizations with weak identity governance, fragmented visibility, and insufficient backup isolation.

IBM reporting indicated that extortion and ransomware-related incidents continue producing breach costs exceeding $5 million on average in many enterprise scenarios.¹

Nevertheless, modern ransomware attacks target enterprises that cannot withstand any operational interruption, including healthcare institutions, logistics organizations, industrial sectors, and managed service providers.

Elevated Risk Facing Critical Infrastructure

One of the most alarming trends in the last year has been the targeting of critical infrastructure operators and healthcare organizations.

According to threat intelligence from some of the top cybersecurity providers, ransomware affiliates now prioritize organizations where disruptions to their operations can have an impact on:

• Public services
• Patient care
• Economic stability
• Manufacturing continuity
• Energy operations
• Transportation systems
• Supply chain resilience

Healthcare environments remain particularly vulnerable because of:

• Legacy systems
• Connected medical devices
• Staffing shortages
• Operational continuity requirements
• Complex third-party dependencies

The manufacturing sector experiences high risks for the same reasons.

According to the IBM Security report, breaches are known to cost companies working within this industry some of the highest losses worldwide, especially due to their operational impact on business resilience and continuity.

Today, ransomware attacks on critical sectors cannot be considered purely financially motivated threats anymore. They have become national security issues.

This shift is driving:

• Stronger regulatory oversight
• Expanded board accountability
• Greater resilience expectations
• Increased cyber reporting obligations
• Increased federal scrutiny

Companies that operate in the realms of health care, energy, transportation, financial services, and government supply chains now feel increasing pressure to showcase cyber maturity.

Cyber Insurance Is Reshaping Enterprise Security Priorities

Cyber insurance providers are also reshaping enterprise ransomware defense strategies.

Over the past nine months, insurers have significantly increased scrutiny around enterprise security controls before issuing or renewing policies.

Organizations lacking maturity:

• Identity governance
• MFA enforcement
• Endpoint detection capabilities
• Offline backup strategies
• Security monitoring
• Incident response planning
• Recovery testing programs

are increasingly facing higher premiums, reduced coverage, or policy exclusions.

This trend is creating secondary economic pressure across enterprise environments.

Investments in security are not being motivated simply by breach prevention purposes. In many cases, businesses are making investments in resiliency in order to stay insurable and decrease their losses after a crisis occurs.

According to Deloitte’s findings, businesses are increasingly integrating cybersecurity investments into enterprise risk management and business continuity strategies rather than limiting them to just an IT issue.

This leads to an increasing complexity within the financial environment associated with ransomware.

Operational Resilience Is Replacing Traditional Perimeter Security

The guidelines on ransomware by NIST released in 2025 form part of an overall trend in the industry towards resilience approaches.

NIST Ransomware Risk Management Guidance makes use of the Cybersecurity Framework 2.0 methodology in assisting organizations to manage, detect, respond to, and recover from ransomware attacks.⁴

The trend is crucial because ransomware can no longer be prevented through precautionary measures alone.

Corporate security officers are now focusing on the following aspects:

• Recovery speed
• Backup integrity
• Incident containment
• Business continuity
• Security automation
• Cyber resilience testing
• Cross-functional response planning
• Recovery orchestration

Organizations have begun realizing that the ability to survive operations is just as important as prevention from threats.

It is also worth noting that while breaches are frequent, organizations can now contain significant impacts due to resilience efforts.

Intelligence-Led Defense Is Now Vital

The current ransomware scenario requires flexibility, knowledge, and intelligence-based decision-making.

A conventional defense strategy might not work against cybercriminals capable of changing their tactics instantly.

Organizations that depend largely on point solutions and limited visibility find it difficult to identify lateral movements and extortion preparation operations prior to disrupting operations.

Therefore, enterprise executives are focusing on intelligence-driven cybersecurity paradigms that incorporate:

• Threat intelligence
• Behavioral analytics
• AI-driven detection
• Continuous monitoring
• Security orchestration
• Exposure management
• Predictive risk analysis
• Threat hunting operations

In this regard, according to McKinsey’s cybersecurity insights, companies that incorporate cybersecurity into their enterprise-level digital transformation strategy have more resilient results and increased operational flexibility during disruptions.⁵

Such a shift comes amid a more general understanding that ransomware mitigation is not simply a matter of increasing your resistance at the perimeter level.

It is rather about establishing an adaptive security system able to withstand cyber-attacks and continue business activities.

Strategic Priorities for U.S. Enterprise Leaders

Some of the key strategic imperatives being observed by business leaders throughout 2026 include:

1. Update Identity and Access Security Protocols

Identity security must be prioritized in cloud environments, SaaS providers, AI implementations, and OT.

2. Automate Security

Firms that leverage automation and artificial intelligence within their SOCs have shown lower breach costs and quicker response times.

3. Enhance Preparedness at the Executive Level

Boards and executives must play an active role in the development of ransomware plans and incident preparedness.

4. Ensure Secure Implementation of AI

The development of AI governance frameworks, access control, and risk management practices must progress quickly.

5. Focus on Resilience and Continuity Planning

The ability to recover from attacks is increasingly becoming an important determinant of impact during ransomware incidents.

6. Third-Party Risk Management

The risk posed by suppliers has increased, expanding the attack surface in organizations.

7. Test Resilience

Businesses must test backup recovery plans, identity protocols, segmentation, and crisis communication plans

Trends for 2026

It is expected that ransomware campaigns will become more adaptive, distributed, and intelligent throughout 2026.

Here are some trends likely to emerge:

• Greater adoption of AI-supported attack automation
• Greater targeting of cloud identity systems
• Expansion of multi-extortion tactics
• More attacks against operational technology environments
• Continued exploitation of third-party ecosystems
• Increased targeting of AI infrastructure and data pipelines
• Higher pressure against critical infrastructure sectors
• Greater regulatory scrutiny surrounding cyber resilience

At the same time, enterprises are becoming more resilient.

Organizations that integrate identity security, automation, resilience engineering, executive governance, intelligence-led operations, and operational continuity planning are likely to reduce both operational disruption and financial exposure.

For U.S. enterprise leaders, ransomware is no longer solely a cybersecurity issue.

It is now a business continuity challenge, an operational resilience challenge, a governance challenge, and increasingly, a competitive risk management challenge.

References

1. IBM Security, Cost of a Data Breach Report 2025, 2025.
2. Deloitte, Cybersecurity Trends Report, 2025.
3. Accenture, State of Cybersecurity Resilience 2025, 2025.
4. NIST, Ransomware Risk Management: CSF 2.0 Community Profile (Draft NIST IR 8374r1), 2025.
5. McKinsey & Company, Cybersecurity Insights and Capabilities, 2025.