By Waseem Ahmed, Head of Engineering, Secure.com
Summary
In April 2025, UK retailer Marks & Spencer lost about £300 million in profit to ransomware. The way in wasn’t clever. Someone phoned the help desk, posed as staff, and walked out with a password reset. No AI. Just an open door.
TL;DR:
Ransomware grew into a billion-dollar criminal industry years before modern AI tools existed. It still breaks in through the same plain doors: stolen passwords, unpatched systems facing the internet, and phishing. AI speeds up a few attacker tasks, but it doesn’t create the opening. So the smart budget move is plain. Pay to close the doors you already have, not to fight a robot attacker that isn’t hurting you.
Ransomware got big before AI showed up
Ransomware was already huge long before anyone typed a prompt into a chatbot.
In 2017, the WannaCry attack hit more than 300,000 computers across 150 countries in a matter of days. That was years before today’s AI tools reached the public, which only happened at the end of 2022.
By then, the business model was already built. Criminal groups rent out their ransomware to others, split the profits, and run their own support desks. One analysis of public attacks counted 277 ransomware gangs between 2015 and 2025, with 102 of them active in 2025 alone.
The trend keeps climbing. Verizon’s 2025 Data Breach Investigations Report found ransomware in 44% of all breaches, up from 32% the year before.
Timeline showing ransomware became a large criminal industry years before modern AI tools reached the public at the end of 2022.Ransomware · scale over time
The industry was built before AI arrived
Ransomware was already a global, organized business long before anyone typed a prompt into a chatbot. AI showed up late.
2017 – WannaCry goes worldwide – One attack hit more than 300,000 computers across 150 countries in days. No AI involved.
2019 to 2021 – The criminal economy matures – Ransomware as a service and data theft extortion become the standard playbook. Gangs rent tools and split profits.
Late 2022 – AI shows up here – Modern AI tools reach the public
Generative AI arrives after the industry is already built. It speeds up a few attacker tasks. It does not open the door.
2025 – Still climbing – Ransomware now shows up in 44% of all breaches, up from 32% a year earlier. The growth needed no AI.
(Sources: Verizon 2025 Data Breach Investigations Report; Mastercard ransomware trends analysis [2026]. Figures are directional.)
The doors attackers use are boring and known
Here is the part that should shape your budget. Attackers rarely need something new. They walk through doors you already know about.
Three openings show up year after year:
- Stolen or weak passwords. Verizon’s 2025 report tied 22% of breaches to stolen credentials.
- Unpatched systems facing the internet. The same report tied 20% of breaches to attackers exploiting a known software flaw, the fastest-growing way in.
- Phishing and social engineering. About 16% of breaches started with a person being tricked.
Attackers love targeting the VPN and firewall. Verizon 2025 DBIR found attacks on VPNs and edge devices grew nearly eight times in a single year. The cyber insurer Coalition traced 58% of its ransomware claims to problems with these same perimeter devices.
Look back at that retailer. The door was a support desk that reset the wrong person’s password. Boring. Known. And it still cost hundreds of millions.
(Share of breaches source: Verizon 2025 DBIR. Each is a separate way in, so they do not add to 100%.)
Two additional stats worth noting:
- ~8x Jump in attacks on VPNs and edge devices in a single year.
- 58% of ransomware claims traced to perimeter devices, per cyber insurer Coalition.
(Source: Coalition 2024 claims data. Figures are directional.)
So where does AI actually fit?
AI helps attackers, but it’s not a magic key.
Researchers who study real ransomware say AI speeds up small tasks. It writes smoother phishing messages. It helps a weak coder clean up buggy malware. In one case, it helped map a target network faster.
None of that opens a locked door. The attacker still needs a stolen password or an unpatched box to get in. The people who track these groups describe AI today as an accelerant, not a revolution.
This matters for spending. Many teams fear a clever AI attacker more than the plain threats sitting in front of them, a gap we covered in our look at what security leaders actually fear. That fear rarely matches where the money is actually lost.
What this means for budgets
If the doors are known, your budget should pay to close them first. Chasing AI threat hype before the basics is spending backward.
Fund the doors, not the hype: If the ways in are known, your budget should pay to close them first. Here is the order that stops the most ransomware per dollar.
1 – Identity and MFA: Make a stolen password useless. Turn on phishing resistant MFA and remove shared logins.
2 – Patch what faces the internet: Fix your VPN, firewall, and public servers first. That is where the exploits land.
3 – Know your attack surface: You cannot close a door you cannot see. Find every exposed system before an attacker does.
4 – Fast detection and response: Assume someone gets in. Catch the early moves and shut them down before files get locked.
5 – Tested backups – Keep copies attackers cannot reach, and practice restoring them.
6 – Supplier risk – Many attacks now ride in through an outside vendor. Put that door in the plan.
Every item is a door, a lock, or a guard. None of it is hype.
FAQs
Does AI make ransomware more dangerous?
A little, but not the way the headlines suggest. AI helps attackers write better phishing and move a bit faster. It does not create the opening. The way in is still a stolen password or an unpatched system.
What is the number one way ransomware gets in?
Known, avoidable weaknesses. Stolen credentials, unpatched internet-facing systems, and phishing lead the list every year. In the Sophos 2025 study, exploited vulnerabilities were the top root cause for the third year running, at 32% of attacks.
Should we budget to pay the ransom?
Plan not to. Paying is getting less reliable, and the cleanup is the real cost. Sophos estimates the average recovery bill, excluding any ransom, at $1.53 million in 2025. Money spent on prevention and backups goes further than money set aside to pay a criminal.
Where should a small team start?
Start with identity and your internet edge. Turn on strong MFA, remove shared accounts, and patch anything exposed to the internet. Those two moves close most of the common doors for the least money.
Does AI help defenders too?
Yes, and this is the better use of it. AI can find your exposed doors before attackers do, and it can speed up detection and response so defenders catch an intrusion early. Used this way, AI pays for itself on defense, not on fear
How Secure.com can help
Secure.com runs governed AI teammates that work above the stack you already own, with your team approving anything that matters. The idea is simple. Attack your own defenses to find the open doors, harden them, and prove the fix.
The Red Teammate acts like the attacker. It hunts for the exposed VPNs, weak spots, and exploitable flaws that ransomware crews use before they find them.
Defensive teammates turn those findings into action, so a weakness becomes a fixed door instead of another line on a report.
The SOC Teammate watches for the early signs of an intrusion and helps shut it down fast, with a full record of every step.
Everything runs inside your rules. Your team sets the scope, approves the big actions, and keeps the audit trail.
You start with one teammate, go live in days, and hand your team back hundreds of hours a month of grunt work.
Attack. Harden. Prove. Repeat.
Guest Post: The ransomware industry scaled just fine without AI. Here’s what that tells your 2027 budget
Posted in Commentary with tags secure.com on October 16, 2026 by itnerdBy Waseem Ahmed, Head of Engineering, Secure.com
Summary
In April 2025, UK retailer Marks & Spencer lost about £300 million in profit to ransomware. The way in wasn’t clever. Someone phoned the help desk, posed as staff, and walked out with a password reset. No AI. Just an open door.
TL;DR:
Ransomware grew into a billion-dollar criminal industry years before modern AI tools existed. It still breaks in through the same plain doors: stolen passwords, unpatched systems facing the internet, and phishing. AI speeds up a few attacker tasks, but it doesn’t create the opening. So the smart budget move is plain. Pay to close the doors you already have, not to fight a robot attacker that isn’t hurting you.
Ransomware got big before AI showed up
Ransomware was already huge long before anyone typed a prompt into a chatbot.
In 2017, the WannaCry attack hit more than 300,000 computers across 150 countries in a matter of days. That was years before today’s AI tools reached the public, which only happened at the end of 2022.
By then, the business model was already built. Criminal groups rent out their ransomware to others, split the profits, and run their own support desks. One analysis of public attacks counted 277 ransomware gangs between 2015 and 2025, with 102 of them active in 2025 alone.
The trend keeps climbing. Verizon’s 2025 Data Breach Investigations Report found ransomware in 44% of all breaches, up from 32% the year before.
Timeline showing ransomware became a large criminal industry years before modern AI tools reached the public at the end of 2022.Ransomware · scale over time
The industry was built before AI arrived
Ransomware was already a global, organized business long before anyone typed a prompt into a chatbot. AI showed up late.
2017 – WannaCry goes worldwide – One attack hit more than 300,000 computers across 150 countries in days. No AI involved.
2019 to 2021 – The criminal economy matures – Ransomware as a service and data theft extortion become the standard playbook. Gangs rent tools and split profits.
Late 2022 – AI shows up here – Modern AI tools reach the public
Generative AI arrives after the industry is already built. It speeds up a few attacker tasks. It does not open the door.
2025 – Still climbing – Ransomware now shows up in 44% of all breaches, up from 32% a year earlier. The growth needed no AI.
(Sources: Verizon 2025 Data Breach Investigations Report; Mastercard ransomware trends analysis [2026]. Figures are directional.)
The doors attackers use are boring and known
Here is the part that should shape your budget. Attackers rarely need something new. They walk through doors you already know about.
Three openings show up year after year:
Attackers love targeting the VPN and firewall. Verizon 2025 DBIR found attacks on VPNs and edge devices grew nearly eight times in a single year. The cyber insurer Coalition traced 58% of its ransomware claims to problems with these same perimeter devices.
Look back at that retailer. The door was a support desk that reset the wrong person’s password. Boring. Known. And it still cost hundreds of millions.
(Share of breaches source: Verizon 2025 DBIR. Each is a separate way in, so they do not add to 100%.)
Two additional stats worth noting:
(Source: Coalition 2024 claims data. Figures are directional.)
So where does AI actually fit?
AI helps attackers, but it’s not a magic key.
Researchers who study real ransomware say AI speeds up small tasks. It writes smoother phishing messages. It helps a weak coder clean up buggy malware. In one case, it helped map a target network faster.
None of that opens a locked door. The attacker still needs a stolen password or an unpatched box to get in. The people who track these groups describe AI today as an accelerant, not a revolution.
This matters for spending. Many teams fear a clever AI attacker more than the plain threats sitting in front of them, a gap we covered in our look at what security leaders actually fear. That fear rarely matches where the money is actually lost.
What this means for budgets
If the doors are known, your budget should pay to close them first. Chasing AI threat hype before the basics is spending backward.
Fund the doors, not the hype: If the ways in are known, your budget should pay to close them first. Here is the order that stops the most ransomware per dollar.
1 – Identity and MFA: Make a stolen password useless. Turn on phishing resistant MFA and remove shared logins.
2 – Patch what faces the internet: Fix your VPN, firewall, and public servers first. That is where the exploits land.
3 – Know your attack surface: You cannot close a door you cannot see. Find every exposed system before an attacker does.
4 – Fast detection and response: Assume someone gets in. Catch the early moves and shut them down before files get locked.
5 – Tested backups – Keep copies attackers cannot reach, and practice restoring them.
6 – Supplier risk – Many attacks now ride in through an outside vendor. Put that door in the plan.
Every item is a door, a lock, or a guard. None of it is hype.
FAQs
Does AI make ransomware more dangerous?
A little, but not the way the headlines suggest. AI helps attackers write better phishing and move a bit faster. It does not create the opening. The way in is still a stolen password or an unpatched system.
What is the number one way ransomware gets in?
Known, avoidable weaknesses. Stolen credentials, unpatched internet-facing systems, and phishing lead the list every year. In the Sophos 2025 study, exploited vulnerabilities were the top root cause for the third year running, at 32% of attacks.
Should we budget to pay the ransom?
Plan not to. Paying is getting less reliable, and the cleanup is the real cost. Sophos estimates the average recovery bill, excluding any ransom, at $1.53 million in 2025. Money spent on prevention and backups goes further than money set aside to pay a criminal.
Where should a small team start?
Start with identity and your internet edge. Turn on strong MFA, remove shared accounts, and patch anything exposed to the internet. Those two moves close most of the common doors for the least money.
Does AI help defenders too?
Yes, and this is the better use of it. AI can find your exposed doors before attackers do, and it can speed up detection and response so defenders catch an intrusion early. Used this way, AI pays for itself on defense, not on fear
How Secure.com can help
Secure.com runs governed AI teammates that work above the stack you already own, with your team approving anything that matters. The idea is simple. Attack your own defenses to find the open doors, harden them, and prove the fix.
The Red Teammate acts like the attacker. It hunts for the exposed VPNs, weak spots, and exploitable flaws that ransomware crews use before they find them.
Defensive teammates turn those findings into action, so a weakness becomes a fixed door instead of another line on a report.
The SOC Teammate watches for the early signs of an intrusion and helps shut it down fast, with a full record of every step.
Everything runs inside your rules. Your team sets the scope, approves the big actions, and keeps the audit trail.
You start with one teammate, go live in days, and hand your team back hundreds of hours a month of grunt work.
Attack. Harden. Prove. Repeat.
Leave a comment »