Are identity recovery procedures lagging in ransomware reports?

TL;DR: Semperis reports that 87% of ransomware incidents targeted identity systems, 84% involved AI, and 60% of organisations still lack identity recovery procedures. Recovery planning has to verify trust in identity services, not just restore data.

Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families”.

By the numbers:

• In 84% of attacks, threat actors weaponized artificial intelligence.
• In 87% of ransomware attacks, threat actors targeted identity systems like Active Directory, Entra ID, and Okta.
• 60% of organizations’ disaster recovery or crisis response plans do not include procedures for identity system recovery.

Key questions

Q: Why do ransomware attacks on identity systems increase business impact?

A: Identity systems control authentication, authorization, and administrative reach, so compromise there can disable recovery, widen access, and undermine trust across the environment.

Q: How can security teams tell whether ransomware recovery will actually hold?

A: Teams should test whether recovery returns identity services to a verified trusted state and whether the same access paths can be reused by an attacker.

Q: What breaks when identity visibility is missing during a ransomware attack?

A: Containment becomes guesswork.

Practitioner guidance

• Audit identity recovery readiness Verify whether Active Directory, Entra ID, Okta, and other identity services can be restored to a trusted state under crisis conditions, not just brought back online.
• Add identity-specific crisis procedures Insert identity restoration, privilege validation, and trust re-establishment steps into disaster recovery and crisis response plans.
• Exercise coercion scenarios Run tabletop exercises that include staff intimidation, family-targeted threats, and out-of-band communications when core systems are unavailable.

Bottom line: Ransomware is increasingly an identity-layer problem, not only a backup-and-restore problem, because attackers target the systems that control authentication and privilege.

Glossary terms: Identity Recovery, Ransomware coercion, Identity Blast Radius, Trusted Restore State

What's in the full report

Semperis' full report covers the operational detail this post intentionally leaves for the source:

• The survey methodology behind the ransomware sample, including the restriction to organisations victimised in the past 12 months
• The sector and country breakdowns behind coercion, repeat attack, and identity-targeting trends
• The recovery posture questions used to assess identity backups, automation, and crisis procedures
• The broader incident-response context that underpins the vendor's recommendations

👉 Read Semperis' 2026 ransomware risk report on AI, coercion, and identity attacks →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →