You cannot negotiate your way out of ransomware problems
Research into 461 ransomware incidents and 237 negotiations shows that technical resilience is more important than negotiation tactics.
Victims with fully recoverable backups negotiate and pay significantly less often. Payment was made in only 18.3% of incidents without communication, compared to 66.7% when victims actually engaged in negotiations.
An offered discount increases the probability of payment, but the size of that discount itself does not appear to be decisive. Longer negotiations lead to discounts more often, but simultaneously appear to be associated with a lower probability of payment.
Professional incident response companies also increase the chance of a discount, but not demonstrably the chance that payment is ultimately made.
Cyber insurance also proves not to be a direct predictor of payment, contradicting a common assumption.
Furthermore, paying offers no guarantee: 2.5% did not receive a decryption key, 6.7% experienced problems or delays, and 7.6% faced renewed negotiations.
The most important defense strategy therefore lies before the attack. Therefore, invest primarily in reliable, actually recoverable backups and recovery processes.