WASHINGTON — The number in the headline is 84 percent. The evidence behind it is a questionnaire answered by what CBS News says were 1,200 IT and security professionals, published by the cybersecurity firm that ran it.
CBS reported on Wednesday that Semperis’s Ransomware Risk Report found AI was exploited in attacks experienced by 84 percent of surveyed victims, and that 44 percent said attackers turned their own AI agents or systems against them. The respondents, CBS said, spanned nine countries and eight industries.
Those are respondents’ reports, not attack data, and the bases keep shifting. CBS’s headline, “AI linked to 84% of ransomware attacks,” says attacks; its body says surveyed victims. Semperis’s own landing page for the report says 84 percent of attacks “weaponized AI in some way,” and separately that 40 percent of respondents were victims of an AI-based ransomware attack. Those are three different denominators, and none is defined.
The Semperis page does not name a research firm, give fieldwork dates or state who qualified as a respondent. It does not mention the 1,200 figure CBS cites, and it does not say what counts as AI involvement. What it does say is that 87 percent of attacks compromised identity infrastructure and that 59 percent of respondents paid a ransom, down from 69 percent last year, a fall the headline number does not mention.
According to CBS News, 69 percent of victims also suffered multiple successful attacks in the past year, more than a third faced psychological or physical threats against employees, and 14 percent said staff or family members were forced to change jobs, offices or homes. The cost of such incidents is rarely visible; EH reported in August that the Fairlife ransomware costs at Coca-Cola stayed undisclosed.
The voices CBS quotes come from the vendor’s side. Chris Inglis, the former White House national cyber director, who sits on Semperis’s board, said: “I think we’re already seeing autonomous attacks.” Courtney Guss, Semperis’s associate vice president of crisis management, said: “AI agents typically try to accomplish their assigned tasks by any means they can.” Neither statement measures how often attackers use AI.
Until the questions and the sample are public, the figure records what victims say about AI, which may differ from what attackers did. What counts as “AI involvement” in a ransomware attack, and who decided, is the question the number does not answer.
