Organizations have never been better prepared against ransomware, according to Hornetsecurity by Proofpoint’s 2027 Ransomware Report. Yet, nearly half (45%) of the IT leaders surveyed lack confidence in their own organization’s protection strategies. Published during a period of high cybercriminal activity in France, this document, the sixth in the company’s annual series, is based on a survey of 400 IT and cybersecurity experts.
The report notes a decrease in the number of incidents. The proportion of organizations reporting a ransomware attack, a malicious software that blocks access to data to extort a ransom, has fallen to around 18%, compared to 24% in the previous edition. This level returns to a value close to the 18.6% recorded previously.
Basic measures are becoming widespread. According to the study, 84% of organizations have a business continuity plan, compared to 82% in the previous report, and 91% protect their backups against ransomware. Only about 3% of respondents whose organization suffered an attack report that a ransom was paid to recover their data, a proportion the report links to the importance of reliable recovery options.
Phishing remains the main entry point
Phishing remains the most cited attack vector. Among respondents whose organization was attacked, 52% cite email or phishing as the entry point, compared to 46% in the previous report. Compromised endpoints come second at 27%, a nearly stable figure, while 7% mention vulnerability exploitation.
Faced with this predominance, companies are strengthening their teams’ training. Thus, 84% of respondents indicate that their company offers security awareness training, up 10 points from the 74% in the previous report, one of the most marked increases in the survey.
Generative AI, a new challenge
The report also looks at generative AI, capable of producing text, images, or voices. According to the survey, 84% of respondents believe it has increased their organization’s concerns about cyberattacks and ransomware. At the same time, only 9% think their employees would be able to reliably recognize an AI-generated phishing or identity spoofing attempt. The report highlights the significant gap between this awareness of risks and the trust placed in teams’ detection capabilities.
Daniel Hofmann, CEO of Hornetsecurity by Proofpoint, believes that “companies have significantly strengthened their defenses against ransomware,” while judging that this “represents an important first step.” He warns of the speed with which attackers adapt their methods: “They use AI to make their deception attempts more convincing, combine email with other communication tools in multi-channel attacks, or employ new obfuscation techniques to bypass security mechanisms.” For him, “achieving a certain level of security once is not enough.”
The report concludes, according to its authors, that email security, employee awareness, identity and endpoint protection, as well as backup and recovery must work together. These measures can help organizations prevent and detect attacks, respond quickly in the event of an incident, and reliably restore their operations. The study was conducted in July and August 2026.
