Topic starter
02/08/2026 11:36 am
TL;DR: Ransomware is moving away from encryption-heavy disruption toward faster data theft and extortion, according to Knowbe4, with Coveware cited on exfiltration in 76% of cases and ransom payments falling as attackers adapt. Backups still matter, but the decisive problem is speed, trust, and human-AI resilience across the attack chain.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “The New Face of Ransomware: How AI and Exfiltration Are Mutating the Threat Landscape”.
By the numbers:
- Data exfiltration appears in 76% of ransomware cases, according to Coveware research cited by Knowbe4.
- Victim access prices fell from about USD $1,427 in Q1 2023 to USD $439 in Q1 2026, according to Darkweb IQ research cited by Chainalysis and Knowbe4.
Key questions
Q: What breaks when ransomware shifts from encryption to exfiltration?
A: Backup-centric defence breaks first, because restoring systems does not undo data theft or the leverage created by disclosure threats.
Q: Why do AI-assisted phishing and credential theft increase ransomware risk?
A: AI can improve targeting, language quality, and volume, which raises the success rate of social engineering and credential collection.
Q: What do security teams get wrong about ransomware response timing?
A: They often assume there is enough time to detect, triage, and contain after initial access.
Practitioner guidance
- Implement phishing-resistant authentication Prioritise hardware or app-based authenticators for high-risk users and administrative access, and reduce reliance on SMS-based MFA wherever possible.
- Deploy email authentication controls Enforce DMARC, DKIM, and SPF so spoofed messages are rejected or quarantined before they reach users, especially for finance and executive workflows.
- Shorten detection-to-containment workflows Rework incident response so triage, access suspension, and isolation can happen within hours of initial access rather than waiting for daily review cycles.
Bottom line: Ransomware is increasingly an exfiltration-and-extortion problem, so confidentiality controls and data movement detection matter as much as restore capability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:49 pm
Ransomware has become a data-governance problem as much as a recovery problem. When exfiltration is the preferred pressure tactic, the control surface shifts from backup integrity to information exposure, disclosure timing, and trust in who can move data out of the environment. That makes identity controls, segmentation, and detection of abnormal access paths central to ransomware governance. Practitioners should stop treating ransomware as a restore-only scenario.
A question worth separating out:
Q: How should organisations align authentication and awareness with ransomware defence?
A: They should treat authentication strength and user verification as active ransomware controls. Phishing-resistant MFA, email authentication, continuous awareness, and behavioural detection work together because each one covers a different failure mode, and none is sufficient on its own against AI-assisted social engineering and rapid post-access abuse.
👉 Read our full editorial: AI is reshaping ransomware into fast exfiltration and extortion