Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families

Semperis' 2026 report found that attackers used AI in 87% of ransomware attacks and targeted identity systems in 87%; nearly 70% of victims were attacked multiple times. Forty percent of attacks involved psychological or physical threats against staff, and in 53% of cases victims said attackers followed through. Only half of surveyed companies had dedicated identity backups, while 40% of disaster recovery or crisis response plans lacked procedures for Active Directory recovery.

Analysis

The report is a demand signal for identity recovery and incident-response tooling, not evidence of an earnings inflection for Microsoft or Okta. Its sample includes only organizations hit by ransomware, and Semperis sells into this problem; attack prevalence and spending intent therefore need independent validation. The commercial opportunity is likely to accrue first to specialized recovery, identity monitoring and response providers, while Microsoft and Okta could see both greater security-tool attach and heightened scrutiny of the identity platforms attackers target. More attacks do not automatically mean higher platform revenue: customers may add controls around these systems or diversify vendors rather than expand core licenses.

Near term, the report alone is unlikely to justify repricing either mapped company. Over 1–3 months, watch disclosed identity-security bookings, retention/seat growth, incident-related customer churn and enterprise spending commentary. Over 6–18 months, successful identity recovery could become a board-level resilience requirement, but implementation complexity and budget competition may slow conversion. The key contrarian point: high attack frequency can raise security spend while also commoditizing basic protection; recovery capability and trusted response may capture more value than generic AI-security claims. A reversal would be weak security bookings despite rising incident awareness, or evidence that buyers consolidate spending into existing platform bundles rather than buy specialist products.

Key Decisions for Investors

• No directional trade in MSFT or OKTA on this release alone: it is a vendor-sponsored, victim-only survey and does not establish incremental revenue, loss rates, or customer behavior for either company.
• Put identity recovery and incident-response vendors on a diligence watchlist; seek independently verified bookings, renewal/retention data, and evidence of paid deployments before taking exposure. Semperis is privately held.
• For MSFT and OKTA, monitor quarterly security-product growth and customer commentary for proof that identity-risk concerns increase paid adoption rather than merely raise support, remediation, or reputational costs.
• Falsify the spend-up thesis if security bookings or retention weaken over the next two reporting cycles, or if enterprise buyers describe bundling existing controls as sufficient; reassess if either company discloses material identity-related disruption or customer losses.