Attackers Used AI Against Singapore at 1.5 Times the Global Rate
Six in ten Singapore organisations hit by ransomware in the past year said their attackers used AI, against 40% globally, a gap Semperis puts at 1.5 times the global rate. The identity security company's annual ransomware report also found that 42% had an AI agent or system inside their own organisation manipulated or exploited, which places the risk on both sides of the perimeter.
The study covers organisations in the United States, Britain, France, Germany, Italy, Spain, Singapore, Canada and Australia. In total, 98% of Singapore respondents said AI was involved in the attack in some way, whether on the attacker's side, the defender's side, or both.
And the tools that saved some defenders failed others. Of the Singapore organisations surveyed, 49% used AI successfully to detect or respond to the attack, while 28% had AI tools in place that failed outright or only partly worked. That split is the finding most likely to shape how security teams justify their spending over the coming year.
Identity systems remain the prime target. 92% of Singapore respondents said attackers exploited or targeted identity infrastructure, including Active Directory at 52%, Entra ID at 48% and Okta at 37%, against a global figure of 87%. Only 54% keep dedicated identity backups, and fewer than half automate recovery of those systems.
The pressure tactics have shifted since the previous edition of the report. Last year, 66% of Singapore organisations said hackers threatened to file regulatory complaints if incidents went unreported, whereas this year the most common threats were blackmail, extortion or public shaming at 47%, and data erasure, destruction or release at 45%, followed by system lockouts or operational sabotage at 37%.
But the coercion has also moved closer to home. Among organisations whose attackers made threats, 56% reported intimidating texts, letters or packages sent to a home or office, and 41% reported threats against family members or friends. A further 14% reported threats of abduction.
The costs show up in the finances as well as the operations. 52% reported business disruption or revenue loss, 47% had cyber insurance cancelled or premiums raised, and 26% paid a ransom, which sits awkwardly beside the finding that recovery readiness lags the attacks themselves.
Semperis executives framed the internal AI finding as the most actionable part of the study. Gerry Sillars, the company's vice president for Asia Pacific and Japan, said organisations need to treat their own AI agents as part of the attack surface, with the same identity controls, permissions and monitoring applied to any privileged account. Chief executive Mickey Bresman said attackers will keep looking for new ways to make victims pay, after double extortion became common once better backups let companies refuse ransom demands.
So the picture is of AI working on both sides of the fight, with a defensive benefit that arrived for some organisations and not for others. Asked what slows response, Singapore respondents named gaps between teams at 49%, too many separate tools at 38% and outdated response plans at 37%, which suggests the bottleneck sits as much in coordination as in technology.
Six in ten Singapore organisations said attackers used AI, against 40% globally, a rate Semperis puts at 1.5 times the global average
42% said attackers manipulated or exploited an AI agent or system inside their own organisation
Identity infrastructure was targeted in 92% of Singapore attacks, including Active Directory, Entra ID and Okta
49% used AI successfully to detect or respond, while 28% had AI tools that failed or only partly worked
Named blockers were cross team communication gaps at 49%, too many tools at 38% and outdated plans at 37%
Source: Semperis
