To prevent AI-powered ransomware, enforce which changes may run on your systems instead of racing to detect each new variant. The code can rewrite itself, but it still has to change the system to do damage. Known-good enforcement checks each attempted change against the system's authorized state and stops the unauthorized one before it executes. Mimic Ransomware Defense makes that decision at the kernel.
Updated 22 October 2026.
The UK's National Cyber Security Centre judges that AI will "almost certainly" keep making intrusions more effective, bringing "an increase in frequency and intensity of cyber threats" through 2027 (NCSC, Impact of AI on cyber threat from now to 2027).
The tooling is already appearing. ESET found PromptLock, which it called the first known AI-powered ransomware: it runs a language model locally to generate malicious Lua scripts on the fly, then executes them. ESET believes it was a proof of concept, not malware deployed in the wild (ESET Research). Google's Threat Intelligence Group found PromptFlux, an experimental dropper that prompts a large language model to rewrite its own source code to evade antivirus software (Google Threat Intelligence Group). Neither is a working attack campaign yet. Both show where the code is heading: a new shape each time it runs.
What does not change is how the malware behaves once it runs. To do damage, it still has to write files, launch processes and modify the registry. That is the gap detection cannot close through faster updates alone. For how these attacks rewrite themselves, see Mimic's explainer on AI-powered ransomware.
Why Detection Fails Against Self-Rewriting Malware
Detection fails because it needs prior knowledge of the artifact it hunts, and regeneration destroys that knowledge faster than defenders can distribute it. The scale of the broader problem isn't hypothetical.
The UK's National Cyber Security Centre recorded 204 nationally significant incidents between September 2024 and August 2025, up from 89 the year before: 48 percent of the 429 incidents its team supported. ENISA calls encrypting ransomware "the most directly impactful threat" in its 2025 landscape, and the way in is getting cheaper: it reports that by early 2025, AI-supported phishing reportedly made up more than 80 percent of observed social engineering activity worldwide (ENISA Threat Landscape 2025). A defense that depends on recognizing the threat is only as current as its last update:
- Breaks signature matching: A rewritten binary produces a new hash before the previous one reaches your endpoints.
- Outruns signature and hash-based matching: Fresh obfuscation invalidates the specific artifact a detection tool was trained to recognize.
- Voids reputation lookups: A file that nobody has seen before carries no history to score.
Stopping ransomware that rewrites itself starts by understanding how these attacks work. A control that asks what a file is about, not what it looks like, gives a new variant no advantage. The question stays the same every time. That property shifts the decision from recognition to authorization.
Recognition has nothing stable to hold on to when the code keeps changing. So the decision moves from recognition to authorization, where the code's shape no longer matters.
How Does Known-Good Enforcement Stop AI-Powered Ransomware at the Kernel?
Known-Good Enforcement stops these attacks by evaluating every attempted change against a verified model of the system’s authorized state, before the change executes. The decision never asks for the code; it asks whether the change appears in the model.
The FBI's Internet Crime Complaint Center received more than 3,600 complaints reporting ransomware in 2025, with reported losses of $32.3 million, out of $20.877 billion in losses across all complaints, up 26 percent from 2024. It identified 63 new ransomware variants and named ransomware among the highest reported cyber threats to critical infrastructure. IC3 notes that its loss figures don't normally include lost business, time, wages, files or equipment, so the real cost runs higher (FBI IC3, 2025 Internet Crime Report).
Mimic profiles the protected system during onboarding and records its authorized files, processes, registry keys and services. That profile becomes the enforcement policy, so it captures how the host legitimately runs rather than what threats look like. Authorized operations continue, which keeps enforcement workable where downtime is least tolerable.
An unauthorized change doesn't run, whatever the code looks like. Mutation changes nothing that matters, because the attack still can't execute a change the model hasn't authorized.
Enforcement holds a fixed position while the attacker's code moves. Because the model is built from what your systems actually do, it doesn't depend on knowing the attacker's code.
What Known-Good Enforcement Is Not
Known-Good Enforcement isn't a detection product, a backup product or an application allowlist. It's a layer that decides whether a requested change is authorized, alongside the tools you already run. The kernel-level enforcement guide explains how that decision is made and how it compares with detection tools.
Three boundaries separate enforcement from the categories it resembles:
- Asks a different question than detection: Enforcement rules on a change before it executes. Detection alerts on activity that looks malicious.
- Acts before recovery begins: For protected critical applications, stopping the change at the point of execution leaves no data-loss window to clean up.
- Judges change, not applications: An allowlist asks which programs may run, and enforcement asks which changes may happen.
So is enforcement only about ransomware? No. Stopping AI-generated ransomware and governing what AI agents change are one control with two applications. Mimic AI Guardrails extends it to agents, and agentic AI governance covers the wider discipline. The enforcement question doesn't change when the requester does.
Stopping AI-powered ransomware, answered.
Can Known-Good Enforcement stop ransomware it has never seen?
+The enforcement decision requires no prior knowledge of the variant. Mimic evaluates whether the requested change sits inside the authorized model, so an unauthorized encryption attempt fails whether the ransomware family is well documented or brand-new. Novelty gives the attacker nothing because the question is never what the code is.
How is enforcement different from detection?
+Detection asks whether activity looks malicious, by matching it to signatures or behavioral patterns, and many tools block what they recognize. Enforcement asks whether a change was authorized, before it executes, and matches nothing. One approach needs to know what the attack looks like. The other needs to know what your approved state looks like, which is information you already control.
Does this replace my EDR or backup?
+Mimic runs alongside both, and deployment removes nothing. Endpoint detection and response (EDR) tools identify activity that is already underway, and backup restores data after an incident. Enforcement covers what can be lost between those two jobs by making the unauthorized change fail the moment an attacker attempts it.
Does enforcement slow systems down?
+Enforcement overhead is tunable. Authorized operations proceed because Mimic builds the model from each system's own approved state rather than from a generic policy, so normal work already matches it. Mimic's enforcement logic runs in a WebAssembly sandbox. No reboots required.
What if AI malware targets Mimic itself?
+Mimic’s own processes are protected at the kernel layer. They cannot be terminated or modified by userspace processes, including privileged ones. Malware holding administrative credentials still operates above that layer, so tampering with the enforcement decision is itself an unauthorized change and fails the same check.
Enforce Known Good Before the Next Variant Arrives
Architectural protection changes your board conversation. The answer stops being how fast you detected and becomes whether the change could execute. PromptFlux and PromptLock show where the code is heading. Preventing AI-powered ransomware means the answer stays the same however often the next variant rewrites itself.
Request a technical briefing with our engineers and see enforcement in your environment. Mimic Ransomware Defense will show the kernel-level decision on live change attempts, so you finish with a clear view of what does not execute.
