The IT Nerd

By Waseem Ahmed, Head of Engineering, Secure.com

Summary

In April 2025, UK retailer Marks & Spencer lost about £300 million in profit to ransomware. The way in wasn’t clever. Someone phoned the help desk, posed as staff, and walked out with a password reset. No AI. Just an open door.

TL;DR:

Ransomware grew into a billion-dollar criminal industry years before modern AI tools existed. It still breaks in through the same plain doors: stolen passwords, unpatched systems facing the internet, and phishing. AI speeds up a few attacker tasks, but it doesn’t create the opening. So the smart budget move is plain. Pay to close the doors you already have, not to fight a robot attacker that isn’t hurting you.

Ransomware got big before AI showed up

Ransomware was already huge long before anyone typed a prompt into a chatbot.

In 2017, the WannaCry attack hit more than 300,000 computers across 150 countries in a matter of days. That was years before today’s AI tools reached the public, which only happened at the end of 2022.

By then, the business model was already built. Criminal groups rent out their ransomware to others, split the profits, and run their own support desks. One analysis of public attacks counted 277 ransomware gangs between 2015 and 2025, with 102 of them active in 2025 alone.

The trend keeps climbing. Verizon’s 2025 Data Breach Investigations Report found ransomware in 44% of all breaches, up from 32% the year before.

Timeline showing ransomware became a large criminal industry years before modern AI tools reached the public at the end of 2022.Ransomware · scale over time

The industry was built before AI arrived

Ransomware was already a global, organized business long before anyone typed a prompt into a chatbot. AI showed up late.

2017 – WannaCry goes worldwide – One attack hit more than 300,000 computers across 150 countries in days. No AI involved.

2019 to 2021 – The criminal economy matures – Ransomware as a service and data theft extortion become the standard playbook. Gangs rent tools and split profits.

Late 2022 – AI shows up here – Modern AI tools reach the public

Generative AI arrives after the industry is already built. It speeds up a few attacker tasks. It does not open the door.

2025 – Still climbing – Ransomware now shows up in 44% of all breaches, up from 32% a year earlier. The growth needed no AI.

(Sources: Verizon 2025 Data Breach Investigations Report; Mastercard ransomware trends analysis [2026]. Figures are directional.)

The doors attackers use are boring and known

Here is the part that should shape your budget. Attackers rarely need something new. They walk through doors you already know about.

Three openings show up year after year:

• Stolen or weak passwords. Verizon’s 2025 report tied 22% of breaches to stolen credentials.
• Unpatched systems facing the internet. The same report tied 20% of breaches to attackers exploiting a known software flaw, the fastest-growing way in.
• Phishing and social engineering. About 16% of breaches started with a person being tricked.

Attackers love targeting the VPN and firewall. Verizon 2025 DBIR found attacks on VPNs and edge devices grew nearly eight times in a single year. The cyber insurer Coalition traced 58% of its ransomware claims to problems with these same perimeter devices.

Look back at that retailer. The door was a support desk that reset the wrong person’s password. Boring. Known. And it still cost hundreds of millions.

(Share of breaches source: Verizon 2025 DBIR. Each is a separate way in, so they do not add to 100%.)

Two additional stats worth noting:

• ~8x  Jump in attacks on VPNs and edge devices in a single year.
• 58% of ransomware claims traced to perimeter devices, per cyber insurer Coalition.

(Source: Coalition 2024 claims data. Figures are directional.)

So where does AI actually fit?

AI helps attackers, but it’s not a magic key.

Researchers who study real ransomware say AI speeds up small tasks. It writes smoother phishing messages. It helps a weak coder clean up buggy malware. In one case, it helped map a target network faster.

None of that opens a locked door. The attacker still needs a stolen password or an unpatched box to get in. The people who track these groups describe AI today as an accelerant, not a revolution.

This matters for spending. Many teams fear a clever AI attacker more than the plain threats sitting in front of them, a gap we covered in our look at what security leaders actually fear. That fear rarely matches where the money is actually lost.

What this means for budgets

If the doors are known, your budget should pay to close them first. Chasing AI threat hype before the basics is spending backward.

Fund the doors, not the hype: If the ways in are known, your budget should pay to close them first. Here is the order that stops the most ransomware per dollar.

1 – Identity and MFA: Make a stolen password useless. Turn on phishing resistant MFA and remove shared logins.

2 – Patch what faces the internet: Fix your VPN, firewall, and public servers first. That is where the exploits land.

3 – Know your attack surface: You cannot close a door you cannot see. Find every exposed system before an attacker does.

4 – Fast detection and response: Assume someone gets in. Catch the early moves and shut them down before files get locked.

5 – Tested backups – Keep copies attackers cannot reach, and practice restoring them.

6 – Supplier risk – Many attacks now ride in through an outside vendor. Put that door in the plan.

Every item is a door, a lock, or a guard. None of it is hype.

FAQs

Does AI make ransomware more dangerous?

 A little, but not the way the headlines suggest. AI helps attackers write better phishing and move a bit faster. It does not create the opening. The way in is still a stolen password or an unpatched system.

What is the number one way ransomware gets in?

 Known, avoidable weaknesses. Stolen credentials, unpatched internet-facing systems, and phishing lead the list every year. In the Sophos 2025 study, exploited vulnerabilities were the top root cause for the third year running, at 32% of attacks.

Should we budget to pay the ransom?

 Plan not to. Paying is getting less reliable, and the cleanup is the real cost. Sophos estimates the average recovery bill, excluding any ransom, at $1.53 million in 2025. Money spent on prevention and backups goes further than money set aside to pay a criminal.

Where should a small team start?

 Start with identity and your internet edge. Turn on strong MFA, remove shared accounts, and patch anything exposed to the internet. Those two moves close most of the common doors for the least money.

Does AI help defenders too?

 Yes, and this is the better use of it. AI can find your exposed doors before attackers do, and it can speed up detection and response so defenders catch an intrusion early. Used this way, AI pays for itself on defense, not on fear

How Secure.com can help

Secure.com runs governed AI teammates that work above the stack you already own, with your team approving anything that matters. The idea is simple. Attack your own defenses to find the open doors, harden them, and prove the fix.

The Red Teammate acts like the attacker. It hunts for the exposed VPNs, weak spots, and exploitable flaws that ransomware crews use before they find them.

Defensive teammates turn those findings into action, so a weakness becomes a fixed door instead of another line on a report.

The SOC Teammate watches for the early signs of an intrusion and helps shut it down fast, with a full record of every step.

Everything runs inside your rules. Your team sets the scope, approves the big actions, and keeps the audit trail.

You start with one teammate, go live in days, and hand your team back hundreds of hours a month of grunt work.

Attack. Harden. Prove. Repeat.

As we’re all learning, in both frontier AI models and enterprise tools now in use, AI can get it wrong. 

Most security teams don’t discover that an AI tool was wrong during testing. They find out either when an alert storm starts, their analysts stop trusting the tool, or a real threat slips through undetected.

Teams are asking how they can validate outputs in live environments before they cost time, money or a breach. It’s not yet a publicly discussed issue, but it’s one of the most important ones a security team has to resolve.

Yasir Zahid, Cybersecurity Leader and Founding Member with Secure.com, has published the helpful guidelines in his analysis: “How Do You Validate the Outputs of AI-Native Security Tools in a Live Environment?“

Among key takeaways:

• AI outputs in live environments can be 45-50% less accurate than vendor tests suggest.
• Shadow mode testing, monthly Red Team replays, and metric drift tracking are the three most practical tools for live environment validation.
• If the AI cannot explain why it made a call, you can’t verify whether it was right.
• Analyst override rates are the most honest feedback signal you have. If analysts are regularly rejecting AI recommendations, that tells you what needs to change.
• Validation is ongoing, not a one-time setup task. Model behavior drifts as environments change, and that drift needs to be checked monthly.

You can read more here: How Do You Validate the Outputs of AI-Native Security Tools in a Live Environment? – Secure Blog

With organizations adopting AI-powered SOCs, much of the attention focuses on reducing false positives. False negatives where AI falsely clears an attack or its early phases is far less discussed, but far more problematic.

Yasir Zahid, Cybersecurity Leader and Product Builder with Dubai-based Secure.com, has just published “When an AI SOC Gets It Wrong: False Negatives, Risk, and What Comes Next.“

Yasir’s detailed analysis recognizes that AI SOCs miss real threats more often than SOC teams and their organizations expect, and lays out the costs of false negatives to the average organization.

• AI detection tools lose ~between 45 and 50 percent of their tested accuracy when deployed in real environments because of differences in data, infrastructure and dynamic, evolving threats.
• Up to 40 percent of alerts in a standard SOC go completely uninvestigated – and that slow detection is a strong potential driver for escalating estimates of the cost of a data breach.
• An effective SOC is a  well-governed one that logs what it missed, flags gaps, routes uncertain signals to human review, and escalates ambiguous as well as high-risk cases to supervising humans.

You can read more here: What Happens When an AI SOC Misses a Threat

Dubai-based Secure.com has just issued “21 Holes in 3 Production Stacks: What AI Pentesting Actually Finds in 2026,” new research proving just how far AI-driven pentesting has moved from theory to operational risk. In a single weekend, an automated pipeline with no human in the loop uncovered 21 vulnerabilities across three live production stacks, including 7 critical issues tied largely to basic security hygiene failures.

Secure.com researchers pointed an AI-driven pentesting pipeline at three well-known production systems and found

• Multi-tenant e-commerce marketplace: Frontend Runtime Config Leaked on Every Page Load; Unauthenticated Scheduler & Admin Endpoints; Unauthenticated Notification Injection
• Generative AI imaging platform: Cross-Origin Session Theft Across All Four Backend APIs; Admin Dashboard Publicly Reachable
• Popular consumer password manager: Full Production Environment Exposed in Public JavaScript Bundle

This materially changes the economics of both attack and defense. What until now took skilled human testers and significant budget can be executed continuously for roughly $18 per hour, raising questions about whether periodic pentesting models are still viable.

21 Holes in 3 Production Stacks – What AI Pentesting Actually Finds in 2026: Three clients. Three very different architectures. One weekend of machine time: https://www.secure.com/resources/holes-production-stacks

Dubai-based Secure.com has published a concise analysis of both sides of the coin in  “The CISO’s Guide: When AI Helps vs. Hurts Security.”

With research revealing that 76% of CISOs reporting that they expect a material cyberattack in the next 12 months, most report that their organizations are already using AI in some form.

The Guide examines key issues including:

• Where AI Actually Delivers for the SOC:  AI doesn’t think, it predicts, and every model’s no better than the data it was trained on.
•  Where and How AI Can Quietly Hurt The Organization
• The Four Questions to Ask Before Deploying Any AI Security Tool: Every AI system makes mistakes. The question is whether mistakes are recoverable.
• Building a Security Program Where AI and Humans Work Together: Gall’s Law applies.
• Shadow AI Prevention Measures: Shadow AI is a growing internal risk that can expose sensitive data without the user realizing it.
• Metrics to measure deployment success.

The question is no longer “should we use it?” It’s “are we using it in the right places?” The CISO’s Guide delivers a clear, honest answer to that question, and full content is below.

You can read the analysis here: The CISO’s Guide: When AI Helps vs. Hurts Security

Dubai-based Secure.com has just published – “Designing Security Workflows Humans Don’t Hate” based on input from organizations across more than 30 countries. 

CEO Uzair Gadit advocates for human-first security workflows, designed around how people actually work, not how tools were built. The human-first approach surfaces what is relevant, removes friction from the right actions, and puts human judgment where it is needed most, instead of everywhere.

He said: “Most security workflows treat people like machines. They expect analysts to process hundreds of alerts, jump between tools, and make fast decisions under pressure all day, every day. Over 70% of SOC professionals say they have considered quitting due to stress and unmanageable alert volumes. That isn’t  a sign of weak teams. It’s a sign of broken workflows.”

The brief analysis examines:

• Why most security workflows drive people away, amplifying rather than reducing risk;
• Elements of human-first security design; and
• Human-in-the-loop versus automation – where it works, where it doesn’t.

You can read the analysis here: https://www.secure.com/blog/human-centered-security-workflows

Today, Uzair Gadit, Founder & CEO of Dubai-based Secure.com ( https://www.secure.com/ ), published new analysis: “Open Source Dependency Risk Management,” which begins with the reminder that most apps today run on open source code, and 84% of those codebases carry at least one known security vulnerability.

He discusses why open source dependency risk management is important to SMBs, MSSPs and enterprises alike, noting that:

• Scale makes manual tracking impossible,
• Attackers know developers trust open source, 
• Regulatory pressure is rising,
• Unfixed vulnerabilities compound over time, and
• License misuse can cost millions. 

In addition to examining some common risks of O/S dependencies, such as security vulnerabilities,  malware injections, transitive dependencies and unmaintained code, the analysis offers specific risk reduction recommendations.

These include enforcing a quality gate on coding, and effective tracking to measure open dependency risks over time, as well as their severity and the organization’s resolution speed.

The recommendations are timely, given that Sam Sabin of Axios reported today that volunteers “who keep open-source software running and secure are being flooded with reports from an unlikely source: autonomous AI agents… The vast majority of this software is maintained by volunteers who were already struggling to keep up with the deluge of reports about security flaws. Now, maintainers tell Axios their inboxes are being inundated by a wave of AI-written reports that lack specific details and legitimate errors.“

Open Source Dependency Risk Management: Most apps today run on open source code — and 84% of those codebases carry at least one known security vulnerability:  https://www.secure.com/blog/open-source-dependency-risk-management

Uzair Gadit, Founder & CEO of Dubai-based Secure.com, has just published “Cloud Misconfiguration vs Vulnerability: What’s the Difference? Most cloud breaches aren’t hacks — they’re open doors you forgot to close.“.

The brief post equates mis-configurations. versus vulnerabilities as analogous to open doors versus broken locks.

 “Most IT teams treat every cloud security issue the same way. A new CVE drops? Patch it. But what about the S3 bucket someone left public last Tuesday? That doesn’t show up in a CVE database. It shows up in a breach report.

“Cloud environments are not static. Every new service spun up, every new developer onboarded, every shortcut taken under deadline pressure is a chance for a setting to go wrong. The confusion between misconfigurations and vulnerabilities is costing companies millions — not because they don’t care, but because they’re solving the wrong problem,” Uzair said.

He notes that most security budgets are built around patch management which makes sense on prem, but in the cloud is the wrong playbook.

Uzair offers specific vendor neutral recommendations and key takeaways:

• A leading analyst organization estimates 99% of cloud security failures come from misconfigurations — not software bugs.
• Misconfigurations are easier to exploit. No hacking skills required. A Google search can find an exposed S3 bucket.
• Shadow IT and cloud sprawl cause “configuration drift”, i.e. settings that slowly become unsafe as environments grow.
• The fix is a mix of automated audits (CSPM tools), least-privilege access, and shift-left security in your CI/CD pipeline.

Cloud Misconfiguration vs Vulnerability: What’s the Difference? Most cloud breaches aren’t hacks — they’re open doors you forgot to close: https://www.secure.com/blog/cloud-misconfiguration-vs-vulnerability