AI on both sides: ransomware enters its automated era

Ransomware has always evolved alongside its tools, and its newest and most consequential tool is artificial intelligence. Operators are increasingly using AI to accelerate reconnaissance, craft convincing lures and streamline the early stages of intrusion, making sophisticated attacks faster to mount, easier to scale and harder to distinguish from legitimate activity than they have ever been.

The single most consequential change is to the skill floor of the whole enterprise. Techniques that once demanded real expertise and patience can now be assisted or partly automated, widening the pool of people capable of mounting serious attacks and increasing the sheer tempo of campaigns that defenders must absorb. The barrier to entry for sophisticated crime is falling, and the volume is rising with it.

The crude phishing of the past was its own warning sign; AI-generated lures are polished and personalised.

Where AI helps the attacker

The advantage shows up first and most clearly in the unglamorous early phases of an attack. AI can rapidly sift reconnaissance data to identify promising targets, generate tailored phishing that convincingly mimics a specific victim's context and relationships, and adapt social-engineering lures with a fluency and personalisation that older, templated mass attacks could never achieve. The opening moves are now faster and far more credible.

Convincing, fluent language is the crux of much of it. The crude, error-ridden phishing of the past was often its own warning sign, instantly recognisable to a wary recipient; AI-generated lures, by contrast, are polished, grammatically flawless and personalised to the target, making them far harder for a busy, distracted employee to dismiss in the moment before clicking.

The defenders respond

Defenders are racing, necessarily, to deploy the very same technology on their own side of the line. They are using AI to detect subtle anomalies across enormous volumes of activity, triage the resulting flood of alerts, and respond to threats at machine speed that no human team could match. The contest is becoming, in significant part, a question of which side automates more effectively and adapts more quickly.

That emerging symmetry is genuinely double-edged and offers little comfort. AI undeniably strengthens detection and response, but it simultaneously means the volume, sophistication and speed of attacks rise in lockstep, leaving even well-resourced defenders running hard simply to stay in place. The technology helps both sides, and it is far from obvious that it helps defenders more.

An automation arms race

The long-standing balance between offense and defense now turns, more than before, on tempo — on which side can iterate, adapt and deploy faster than the other. Human expertise still matters enormously, but increasingly it is expertise expressed through and amplified by automation rather than applied manually, case by case. The pace of the contest has fundamentally accelerated.

The uncomfortable conclusion is that AI does not obviously or permanently favour either side; it simply raises the stakes, speed and scale for both at once. The organisations that fare best in this new era will be those that treat sophisticated automated defense not as an expensive luxury or a future project but as a present-day baseline requirement.