Concern about artificial intelligence (AI)-enhanced malicious attacks are top of mind for risk executives, and new concerns regarding soft ransomware targets are also coming to the forefront of enterprise risks, according to a recent report.

During the second quarter of 2024, Gartner’s 2Q24 Emerging Risk Report surveyed 274 senior risk executives and managers to document and compare emerging risks, which are those that hold higher uncertainty because their evolution is rapid, nonlinear, or both.

Three of the top five most cited emerging risks, the report notes, are in the technology category (see table) and new concern regarding soft ransomware targets enter the tracker for the first time. Escalating political polarization, which first entered the tracker in 4Q 2023, held steady as the third most cited concern, while misaligned organizational talent profile moved up from the fifth to fourth most cited risk.

Soft ransomware targets, the report shares, include the types of systems that may be especially vulnerable to ransomware due to underinvestment or technical debt, leading to longer disruptions in business operations when attacks occur. The ease of carrying out such attacks, via what’s known as ransomware-as-a-service (RaaS), allows cybercriminals with even minimal experience and technical skill to deploy attacks at low cost.

The potential impacts of soft ransomware targets, the report points out, range from operational disruptions and delay of services to increased exposure to multi-extortion (for example, ransom demand follows threats of selling, publishing or permanently deleting data) and increased financial burden in the form of direct and indirect costs. Direct costs include ransoms, remediation, litigation and public relations, while indirect costs, such as reputational damage and loss of intellectual property, also create a burden on an organization.

“Similar to AI-enhanced malicious attacks, soft ransomware targets require minimal experience and cost to cause significant financial and reputational damage,” says Gamika Takkar, Gartner’s director of  risk and audit practice research. “RaaS lowers the barrier to entry for inexperienced cybercriminals who know just enough about how to attack and disrupt business operations, creating worse impacts than usual when attacks occur.

“While operational disruption and increased costs are dire consequences of soft ransomware targets, the exposure to extortion can impact not just the organization itself, but any and all associated third-parties as well, further underscoring the importance of understanding and preventing such risk.”