The ransomware industry scaled just fine without AI. Here’s what that tells your budget

TL;DR: Ransomware grew into a billion-dollar criminal industry years before modern AI tools existed. It still breaks in through the same plain doors: stolen passwords, unpatched systems facing the internet, and phishing. AI speeds up a few attacker tasks, but it doesn’t create the opening. So the smart budget move is plain. Pay to close the doors you already have, not to fight a robot attacker that isn’t hurting you.

Ransomware got big before AI showed up

Ransomware was already huge long before anyone typed a prompt into a chatbot.

In 2017, the WannaCry attack hit more than 300,000 computers across 150 countries in a matter of days. That was years before today’s AI tools reached the public, which only happened at the end of 2022.

By then, the business model was already built. Criminal groups rent out their ransomware to others, split the profits, and run their own support desks. One analysis of public attacks counted 277 ransomware gangs between 2015 and 2025, with 102 of them active in 2025 alone.

The trend keeps climbing. Verizon’s 2025 Data Breach Investigations Report found ransomware in 44% of all breaches, up from 32% the year before.

The doors attackers use are boring and known

Here is the part that should shape your budget. Attackers rarely need something new. They walk through doors you already know about.

Three openings show up year after year:

• Stolen or weak passwords. Verizon’s 2025 report tied 22% of breaches to stolen credentials.
• Unpatched systems facing the internet. The same report tied 20% of breaches to attackers exploiting a known software flaw, the fastest-growing way in.
• Phishing and social engineering. About 16% of breaches started with a person being tricked.

Attackers love targeting your VPN and firewall. Verizon found attacks on VPNs and edge devices grew nearly eight times in a single year. The cyber insurer Coalition traced 58% of its ransomware claims to problems with these same perimeter devices.

Look back at that retailer. The door was a support desk that reset the wrong person’s password. Boring. Known. And it still cost hundreds of millions.

So where does AI actually fit?

AI helps attackers, but it’s not a magic key.

Researchers who study real ransomware say AI speeds up small tasks. It writes smoother phishing messages. It helps a weak coder clean up buggy malware. In one case, it helped map a target network faster.

None of that opens a locked door. The attacker still needs a stolen password or an unpatched box to get in. The people who track these groups describe AI today as an accelerant, not a revolution.

This matters for spending. Many teams fear a clever AI attacker more than the plain threats sitting in front of them, a gap we covered in our look at what security leaders actually fear. That fear rarely matches where the money is actually lost.

What this means for your 2026 budget

If the doors are known, your budget should pay to close them first. Chasing AI threat hype before the basics is spending backward.

Here is where the money does the most good:

• Identity and MFA. Make a stolen password useless. Turn on phishing-resistant MFA and remove shared logins.
• Patch what faces the internet. Fix your VPN, firewall, and public servers first. That is where the exploits land.
• Know your attack surface. You cannot close a door you cannot see. Find every exposed system before an attacker does.
• Fast detection and response. Assume someone gets in. Catch the early moves and shut them down before files get locked.
• Tested backups. Keep copies attackers cannot reach, and practice restoring them.
• Supplier risk. Many attacks now ride in through an outside vendor, so put that in the plan.

Notice the pattern. Every item is a door, a lock, or a guard. None of it is hype.

How Secure.com helps

Secure.com runs governed AI teammates that work above the stack you already own, with your team approving anything that matters. The idea is simple. Attack your own defenses to find the open doors, harden them, and prove the fix.

• The Red Teammate acts like the attacker. It hunts for the exposed VPNs, weak spots, and exploitable flaws that ransomware crews use before they find them.
• Defensive teammates turn those findings into action, so a weakness becomes a fixed door instead of another line on a report.
• The SOC Teammate watches for the early signs of an intrusion and helps shut it down fast, with a full record of every step.
• Everything runs inside your rules. Your team sets the scope, approves the big actions, and keeps the audit trail.
• You start with one teammate, go live in days, and hand your team back hundreds of hours a month of grunt work.

Attack. Harden. Prove. Repeat.

Frequently asked questions