Semperis published its 2026 Ransomware Risk Report on 14 October. In 87% of the incidents studied, attackers targeted or abused identity systems such as Active Directory, Entra ID or Okta. Only half of the organisations keep a dedicated identity backup.
Identity security vendor Semperis published its 2026 Ransomware Risk Report on 14 October 2026. The findings come from a survey of 1,200 IT and security professionals across nine countries, all of them working at organisations that had already suffered at least one successful ransomware attack. Because only victims were surveyed, the numbers describe how attacks unfold rather than how likely an attack is.
The headline finding is where attackers go first. In 87% of the incidents studied, they targeted or abused identity systems rather than starting with files. Broken down by platform, Active Directory was hit in 51% of cases, Entra ID in 48% and Okta in 27%; these categories overlap.
Why this matters
The identity system decides who may reach which server, which folder and which application. Once Active Directory is under an attacker's control, there is no need to break into machines one at a time: administrator rights open the file server, the backup server and the virtualisation layer at once. A breach at the identity layer is therefore a far wider event than a single infected workstation.
The report also points to a recovery gap. Only 50% of the organisations surveyed keep a dedicated backup of their identity system and 42% use automated identity recovery tooling. Documented recovery procedures exist for Active Directory at 60% of organisations and for Entra ID at 52%. In short, many companies that back up their files have no written plan for bringing the directory itself back.
What this means for SMEs
Most small and mid-sized companies in Turkey still run Active Directory on an on-premises Windows Server. Accounting software, ERP, file shares and printer permissions all hang off that directory, and in many offices the backup server is joined to the same domain and managed with the same administrator account. That is exactly the setup the report describes: compromise the identity layer and the backup goes with it.
Repeat exposure is the second concern. 69% of the victims surveyed were hit by more than one successful attack within a year, 59% paid a ransom, and 53% of those who paid did so more than once. Restarting the servers after an incident is clearly not the end of the story. Under Turkey's KVKK rules, an incident that reaches the identity system also makes it harder to establish which personal data was accessed, which is a problem inside the 72-hour breach notification window.
What Kamer Bilişim recommends
- Separate backup from the domain. The backup server's management account should not be a domain account, and at least one copy of the backup should be kept offline or immutable, so that a copy survives even if a domain administrator account is compromised.
- Write a recovery plan for Active Directory itself. A file backup is not a directory backup. Take system state / AD backups, rehearse a restore in an isolated environment at least once a year, and keep the steps in writing.
- Reduce administrator accounts and enforce multi-factor authentication. Review how many Domain Admins exist, use separate standard accounts for day-to-day work, and require MFA on remote access and Microsoft 365 sign-ins.
We can review your current Active Directory, backup and permission setup against these three points together. We work on site across the Anatolian side of Istanbul and remotely elsewhere. To request an assessment, reach us through our contact page.
Source: Semperis 2026 Ransomware Risk Report (14 October 2026); Help Net Security, 19 October 2026; Cyber Press, 15 October 2026.
Source: Semperis