Skip to content
T threat.cafe

· Margot Reyes (editorial persona) · MSP and SMB channel · on threat.cafe

Small firms are 96% of ransomware victims: why MSPs should rank agent-running developer machines first

Small organisations account for 96% of ransomware victims in the 2026 Verizon Data Breach Investigations Report, according to the Cyber Readiness Institute's summary of the DBIR. The same summary says 73% of ransomware victims had an infostealer or credential compromise, and that 50% had credentials stolen within 95 days before the attack. For an MSP, that makes stolen credentials the thing to rank client machines by. The machines that run AI coding agents and hold cloud keys go first. In February 2026, fake agent installers became a documented way to get stealers onto exactly those machines.

The headline metric that changes the question

The 96% figure tells an MSP that its client base is where ransomware lands. It does not tell the MSP where to spend the next hour of engineering time.

The 73% figure does. Its denominator is ransomware victims in the DBIR dataset, not all small businesses. Within that group, nearly three in four had lost credentials to an infostealer or another compromise. The 95-day figure adds a timing signal: for half of them, the theft came weeks before the encryption, not minutes.

A gap of weeks is long enough to act on. If an MSP sees a stealer hit and rotates every credential on that machine within days, it cuts off the path the 95-day figure describes.

Why "same baseline for every seat" is incomplete

Most MSPs apply one hardening baseline per seat, priced per seat. The habit has a sound basis. The DBIR's lead finding for 2026 is that vulnerability exploitation, at 31% of breaches, has overtaken stolen credentials as the top way in, per Verizon's 19 May 2026 release. CRI's summary also cites unpatched edge devices at 29% and compromised credentials at 38%, without stating the denominator for either. Patching firewalls and VPN appliances stays a first-order job.

Two populations are being mixed here, though. The 31% describes all breaches. The 73% describes ransomware victims. An MSP whose small clients mainly fear ransomware should read the figure that matches that threat.

The even-baseline habit also assumes every seat holds similar secrets. That assumption fails for developer machines. A laptop running an AI coding agent typically carries source-control tokens, package-registry tokens, cloud CLI credentials and the agent's own API key. Huntress notes that legitimate OpenClaw configurations alone "contain an array of sensitive information, including passwords, API keys, and more."

The figures, with their populations

Every number below comes from one of two documents. The population column matters more than the percentage.

Figure  What it measures                          Population            Source
------  ----------------------------------------  --------------------  ---------------
96%     share of ransomware victims that are      DBIR 2026 ransomware  CRI summary
        small organisations                       victims
73%     ransomware victims with an infostealer    DBIR 2026 ransomware  CRI summary
        or credential compromise                  victims
50%     credentials stolen within 95 days         base not stated in    CRI summary
        before the ransomware incident            the summary
31%     breaches starting with vulnerability      all DBIR 2026         Verizon release
        exploitation                              breaches
48%     breaches involving a third party          all DBIR 2026         Verizon release
                                                  breaches
45%     employees using AI tools frequently       employees (up from    Verizon release
                                                  15% a year earlier)
67%     AI users on non-corporate accounts        AI users on work      CRI summary
        on work devices                           devices

The agent-specific slice comes from a third source. Huntress documented fake OpenClaw installer repositories on GitHub that were live between 2 and 10 February 2026. A malicious repository became the top suggestion in Bing's AI search results for "OpenClaw Windows". The Windows builds delivered the Vidar stealer, PureLogs Stealer and GhostSocks proxy malware. The macOS path delivered a variant of Atomic macOS Stealer. GitHub removed the repositories within eight hours of Huntress reporting them.

GhostSocks matters for the ransomware question. Huntress says it turns an infected machine into a proxy that attackers can use to get past anti-fraud and MFA checks, so stolen credentials get used from the victim's own address.

A second campaign used the same payload family through a different door. The Hacker News reported that Koi Security found 341 malicious skills on ClawHub, and that 335 of them used a fake "Prerequisites" step to install Atomic Stealer.

Inference, labelled as such: the link between these campaigns and ransomware at MSP clients is an inference. CRI's summary does not say how many stolen credentials came from developer machines or agent lures, and no public dataset breaks that out yet. What the data supports is narrower. Credential theft precedes most ransomware in the DBIR population, and agent tooling has become a working stealer lure aimed at the people who hold the most valuable credentials.

Competing explanations

Edge devices may dominate for some clients. If a client runs an unpatched VPN appliance, that is the higher priority. The 29% edge-device figure is a reminder that endpoint credentials are one route among several.

Credential compromise is broad. The 73% includes any infostealer or credential compromise, which covers reused passwords and phishing as well as malware. Developer machines may be a small share of it.

The dataset is not a random sample. The DBIR is built from incident data that contributors supply. Its shares describe that dataset, which may over- or under-represent small firms relative to all ransomware events.

None of these explanations argues for treating all seats the same. They argue for keeping edge devices in the top tier alongside high-value endpoints.

Methodology and limits in plain sight

  • The figures come from CRI's secondary summary, published 1 June 2026, and from Verizon's press release. This article did not re-read the full DBIR. Each number is quoted the way its source states it.
  • The 95-day figure's denominator is ambiguous in the summary. It may describe half of the 73% group or half of all victims. The prioritisation below works either way.
  • There is no agent-specific share in any source cited here.
  • The Huntress and Koi findings are single campaigns, each counted by the firm that found it.

The prioritisation matrix

Rank each client machine on two questions. Does it install or run developer tooling or AI agents? Does it hold long-lived credentials for cloud, source control, package registries or admin consoles?

                          Holds high-value keys        No high-value keys
                          ---------------------        ------------------
Runs agents or dev tools  TIER 1                       TIER 2
                          daily stealer alert review   weekly review
                          rotation on any stealer hit  standard rotation
                          installer source checks      installer source checks

No agents or dev tools    TIER 2                       TIER 3
                          weekly review                standard baseline
                          MFA and token lifetime       patch and backup
                          review

Edge devices (VPN, firewall, remote access): always TIER 1, patch first.

Tier 1 means three things in practice:

  1. Treat any stealer detection as a full credential event. Rotate every token and key on that machine from a clean device, not from the infected one.
  2. Check where agent software came from. An installer from the vendor's own site or documented package is different from a GitHub release found through a search suggestion.
  3. Shorten token lifetimes where the service allows it. A token that expires in hours is worth less to a buyer of stolen logs than one that lasts a year.

Onboarding and QBR checklist

  1. Ask each client which staff run AI coding agents or install developer tools. Confirm with your software inventory rather than the answer alone.
  2. For each of those machines, list the credentials on disk: cloud CLI files, .env files, agent config files and registry tokens.
  3. Record where each agent was installed from.
  4. Place each machine in a tier. Report the Tier 1 count per client at every QBR.
  5. Agree a rule with the client in writing: a stealer hit on a Tier 1 machine triggers rotation of every credential listed in step 2.
  6. Re-run steps 1 to 4 every 95 days. The window comes from the CRI figure.

What would change this ranking

Two findings would change the matrix. If the full DBIR shows that most credential compromise among small-firm ransomware victims came from edge-device or VPN credentials, edge devices should move above agent endpoints. If a dataset shows that agent-running machines are no more often stealer-infected than other staff machines, Tier 1 and Tier 2 should merge.

Until either appears, the cheapest high-yield move is to know which client machines run agents and what keys they hold.

If you run an MSP and want to shape the planned multi-tenant client views, the threat.cafe early-access list is open to design partners.

Sources

#msp #ransomware #infostealers #dbir-2026 #developer-endpoints

All posts