AI autonomous ransomware: the evidence

AI autonomous ransomware describes a proposed attack in which software carries out much of the intrusion, theft and encryption workflow with limited human direction. It is a useful scenario to prepare for, but it should not be confused with evidence that every stage is already operating independently in ordinary ransomware campaigns.

AI assistance, autonomous execution and a fully autonomous campaign are different claims. An attacker using a model to write a message is not the same as an agent choosing targets and conducting an entire attack. IT leaders need that distinction when deciding what to fund.

What the research establishes

Darktrace's State of AI Cybersecurity 2026 summary, published on 3 February, reports a survey of more than 1,500 security leaders and practitioners. It says 73% of respondents saw a significant impact from AI-powered threats on their organisation.

That is a survey of perceptions from a security supplier. It is not a measured percentage of ransomware incidents involving AI, and it does not establish how many campaigns completed an autonomous sequence. The same limitation applies when respondents report concern about agents or confidence in defensive AI.

A laboratory demonstration can establish that a system completed a task under the study's conditions. To apply it to your business, inspect the starting access, available tools, target configuration, human preparation, number of attempts and definition of success. A successful demonstration does not by itself measure the frequency or reliability of the same behaviour in real attacks.

Treat predictions about future autonomous ransomware as forecasts. Do not convert a vendor prediction, a benchmark result or an unverified percentage into a statement that fully autonomous campaigns are an established universal threat.

Why the distinction changes the investment decision

If the immediate weakness is an exposed remote-access service, patching and access control address that weakness regardless of whether the attacker uses AI. If the weakness is that nobody responds to alerts overnight, a new detection feature will not solve the missing response ownership by itself.

An AI-labelled product should therefore answer a specific requirement. Ask what activity it detects, how it was evaluated, which false positives it creates and what action it can take. Compare it with improving an existing control. The purchasing decision should follow the gap, not the terminology in a threat report.

Walk through a planning scenario

The following sequence is a hypothetical exercise, not a claim about a confirmed incident. It helps a team test whether its controls work when an attacker automates tasks.

Do not assume that each stage succeeds. The purpose is to identify which control interrupts the sequence and how the team knows. A denied action without a reviewed alert may be a successful preventive control and a monitoring gap at the same time.

Reduce access before adding automation

Inventory externally reachable services and the accounts that administer them. Verify supported software, update ownership, MFA coverage and unnecessary remote access. Include unmanaged devices and suppliers with access to shared resources.

Keep identity controls and network segmentation together. A stolen account should not have unrestricted access to every service. Review permissions to backups, deployment systems and administrative tools separately from ordinary user access.

For AI agents used inside your own business, record what they can read, change and trigger. Give each integration the access required for its purpose. Separate development from production authority and retain a way to stop activity. An instruction telling an agent to behave safely is not a substitute for an enforced permission boundary.

Make detection actionable

Choose a small number of consequential behaviours and verify whether you can observe them. Examples include unexpected privilege changes, unusual access to sensitive data, disabled security controls and attempts to modify recovery systems.

For each alert, state who receives it, how quickly they must assess it and who can authorise containment. Test the route with a harmless exercise. A log retained in a console nobody checks is not the same as a working detection and response process.

Measure missed and false detections separately. If a test generates an alert, confirm that it contains enough context to investigate and that the assigned person can act. Do not describe a product as effective solely because a demonstration produced a visually impressive dashboard.

Use automated containment within agreed limits

Automation can reduce delay, but an incorrect action can interrupt the business. Define which actions are safe to automate, such as isolating a test endpoint under an approved policy, and which require a person to assess service impact.

Record the trigger, scope, evidence retained and recovery action. Include failure modes such as a lost connection to the management service or a false-positive alert affecting a critical account. The business owner should understand the trade-off before the policy reaches production.

Evaluate AI-assisted triage against the same standards. Check whether its summary accurately reflects the underlying events, whether it omits contradictory evidence and whether a human can inspect the records. A confident generated explanation is not a substitute for the logs.

Prepare containment and recovery together

The CISA ransomware guide describes response and recovery actions. Adapt these to your estate and agree who can isolate affected systems. Do not wait for a complete forensic account before taking proportionate action to contain ongoing harm.

Recovery priorities should follow business impact and technical dependencies. An application may depend on identity, networking, databases and external integrations. A fixed universal restore order cannot account for every environment.

Protect backup administration separately and test recovery with representative data in an isolated environment. Record how long it takes to restore a usable service, not just how long it takes to copy a file. Check the integrity of the restored data and the conditions that could cause reinfection.

The ransomware response playbook provides a separate operational starting point. Your exercise should reveal missing access, suppliers or authority before an actual incident does.

Run a bounded tabletop exercise

For a hypothetical distributor, start with a report that a warehouse workstation is accessing unusual shared folders. The facilitator can introduce evidence of a compromised account, a disputed alert and an unavailable supplier contact in stages.

Ask the participants to decide who leads, what they isolate, what evidence they preserve and how warehouse operations continue. Include a recovery decision where the newest backup may contain the affected configuration. Do not terminate live services or run destructive tools to make the exercise feel realistic.

Record decisions and unresolved questions. Give each gap an owner and a deadline, then repeat the failed part of the exercise after the repair. Completion means the team can demonstrate the corrected response, not merely that it attended a meeting.

Brief the board with evidence and uncertainty

A useful board update separates observed weaknesses, tested controls and uncertain future threats. State the business consequence of the gap, the proposed action, its cost and the risk that remains.

For example: "Our exercise showed that nobody can authorise supplier access revocation outside working hours. We propose named cover and a tested escalation route." That is an actionable finding. "AI attacks are faster, so we need AI defence" does not explain which capability the investment buys.

Track time to assess alerts, authority to contain, recovery test results and overdue remediation. Use those measures to decide whether the programme is improving. The proportion of tools with an AI feature is not an outcome measure.

Get help testing the controls that matter

Book a consultation if you need to assess ransomware readiness or the permissions given to internal AI agents. My security consulting services can help scope an exercise, review detection and recovery evidence and turn the findings into owned work. Bring the services your business cannot operate without and the response arrangements you currently rely on.