Acronis Telemetry Finds Concentrated Automation and Security Risks in SMBs
Summary
Acronis analyzed 100 million script runs across 11,500 organizations, finding automation is concentrated, scripts are often abandoned, and AI-generated scripts are entering production. The findings highlight risks from stale scripts, embedded secrets and misuse of admin
Key points
- Acronis analyzed four years of telemetry covering 100 million automated script runs across 11,500 organizations and 44 data centers; larger workloads partly explain the concentration of activity.
- The top 10% of organizations generated most automation activity, and organizations that automate heavily scheduled 99.5% of their script runs.
- More than half of created scripts were never executed; the article says about 85% become inactive or abandoned, with only about one in five remaining active.
- PowerShell dominated automation in managed IT environments; Bash scripts appeared mainly in macOS contexts.
- AI-generated scripts were more likely than human-written scripts to be executed in production, according to the Acronis telemetry.
- Abandoned scripts may retain credentials, API tokens or configuration details. The article recommends maintaining script inventories, reviewing AI-generated code, removing stale scripts and rotating embedded credentials.
- The article warns that attackers can abuse PowerShell, scheduled scripts and remote-management tools, and cites Microsoft reporting that 79% of ransomware incidents involve compromised remote-management tools.
Article Details
- Publisher
- Acronis
- Report Period
- Four years of production telemetry; cited industry and survey figures are primarily from 2024–2025.
- Scope
- Automation and scripting practices, adoption, lifecycle, and security risks in managed IT environments, including SMBs and MSPs.
- Sample Size
- 100 million automated script runs across 11,500 organizations and 44 data centers.
- Key Statistics
- The top 10% of organizations generated the vast majority of automation activity; the article notes that differences in environment size and workload volume partly influence this concentration.
- Organizations that automate heavily schedule 99.5% of their script runs.
- More than half of created scripts are never executed; 85% are reported as inactive or abandoned.
- GitGuardian reported 23.8 million new secrets in public GitHub commits in 2024; the article says 70% of leaked secrets remain active for years after exposure.
- External research cited by the article found that 45% of AI-generated code samples failed basic security tests.
- Recommendations
- Maintain an inventory of scripts and periodically review and remove stale automation.
- Review AI-generated code before deploying or scheduling it in production.
- Rotate credentials embedded in scripts and review automation for exposed credentials, API tokens, and configuration details.
- Monitor scripting activity as a privileged operation.
MITRE ATT&CK
T1021 · Remote ServicesThe article cites a Microsoft report that 79% of ransomware incidents involve compromised remote management tools and describes attackers exploiting legitimate administrative infrastructure.T1059 · Command and Scripting InterpreterThe article describes attackers abusing scripting environments and automation workflows to run commands.T1059.001 · PowerShellThe article describes attackers using PowerShell to execute commands, move laterally, and persist with tools already present in the environment.T1078 · Valid AccountsThe article says forgotten scripts may retain valid credentials or API tokens that could be reused for unauthorized access.
Vendors
Products
GitHub Copilot[Organizations/Platforms] telemetry and research sources – Acronis, Spiceworks, GitGuardian, GitHub CopilotGNU BashPowerShell dominates real-world IT automation in managed environments, while Bash is mainly seen in macOS contexts.PowerShellAcronis telemetry across 11,500 organizations shows that automation is highly concentrated, with most script activity coming from a small set of organizations and most teams relying on scheduled PowerShell tasks.