Topic starter
22/01/2026 3:07 pm
TL;DR: 76% of respondents struggle to keep pace with AI-powered attacks, while 78% of organizations were attacked in the past year and fewer than 25% recovered within 24 hours, according to CrowdStrike’s State of Ransomware Survey. Identity and session control now matter as much as prevention because response windows are shrinking faster than human review cycles can keep up.
Editorial analysis by NHI Mgmt Group, based on content published by CrowdStrike: “Ransomware Reality: Business Confidence Is High, Preparedness Is Low”.
Key questions
Q: What breaks when ransomware moves faster than identity review cycles?
A: Manual access reviews, delayed approval chains, and periodic recertification all lose value when the attacker can complete meaningful actions inside one authenticated session.
Q: Why does AI-powered ransomware make MFA and password policy alone insufficient?
A: MFA and password policy reduce initial compromise risk, but they do not stop a valid session from being abused once the attacker is inside.
Q: How do organisations know whether ransomware identity controls are actually working?
A: Look for reduced privilege breadth, shorter-lived elevated sessions, and faster revocation when suspicious activity appears.
Practitioner guidance
- Measure identity containment time Track how long it takes to disable a suspicious account, revoke tokens, and terminate active sessions once AI-assisted intrusion is suspected.
- Tighten session-bound privilege scope Reduce the amount of work any authenticated identity can complete in one session, especially for remote admin, help desk, and third-party access paths.
- Prioritise fast revocation paths Pre-authorise emergency revocation workflows for privileged identities so security teams can cut off access without waiting for routine approval loops.
Bottom line: AI-enabled ransomware changes the identity problem by reducing the time defenders have to detect and interrupt abuse of valid access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
10/10/2026 6:46 pm
Identity speed has become a control objective, not just a response metric. CrowdStrike’s survey shows that AI-enabled attacks compress the time between access and damage, which makes slow governance structurally inadequate. Access review, manual triage, and delayed revocation all assume the defender will still have time to act after suspicious behaviour appears. The practitioner conclusion is simple: if the control cannot operate at machine speed, it will be bypassed by machine-speed attack chains.
A few things that frame the scale:
- 54% of ransomware victims had credentials exposed before the attack, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: What should teams do when AI finds attack paths faster than remediation can keep up?
A: They should use exposure-driven prioritisation, with identity and privilege issues at the top of the queue. High-value fixes are the ones that remove reusable access, collapse excess privilege, or cut off multi-step compromise paths. If remediation lags discovery, backlog becomes a measurable control failure, not just an operational inconvenience.
👉 Read our full editorial: AI-enabled ransomware shows why identity speed now matters most