Ransomware victims pay often negotiate payment down first

In the relentless war against digital extortion, the battlefield is constantly shifting. While ransomware attacks continue to pose an existential threat to organizations of all sizes, a new analysis reveals some intriguing shifts in the ransom landscape. Sophos recently released a comprehensive report, The State of Ransomware 2026, pulling together data from over two thousand organizations to paint a picture of current tactics, financial impacts, and emerging defenses.

One of the most striking developments concerns the ransom demands themselves. Despite the severity of these attacks, the actual prices demanded by cybercriminals are starting to soften. The median ransom demand has fallen significantly, dropping to 698,000 dollars from last year’s estimate of $1 million. This trend is mirrored in payment behavior; while 48% of organizations ultimately paid their attackers, a substantial majority found ways to negotiate better deals. In fact, 51% of those who paid managed to secure a payment lower than the initial demand.

This negotiation power exists in part because recovery methods are improving. Backup-based recovery rates for encrypted data have jumped to 66%, marking a twelve percent increase year-over-year. This improvement suggests that robust preparation is slowly easing some of the financial pressure caused by an incident.

However, the picture remains complex. The threat level itself has escalated. Malicious emails and phishing remain the primary entry point for most incidents, accounting for half of all reported attacks. While patching vulnerabilities has seen a slight dip, experts warn that simply applying patches is not enough to close the critical security gap.

The root of many breaches lies in identity. A staggering 79% of recorded attacks initiate with an identity-based approach, meaning attackers leverage stolen or user-provided access credentials to gain initial entry into systems. This focus on human error underscores the need for proactive defense strategies beyond just technical fixes.

The financial cost of recovery remains steep. The average cost to recover from a ransomware incident has escalated, reaching $1.7 million—an increase of eleven percent compared to previous years. This soaring cost is compounded by the difficulty small organizations face in mounting a strong defense. Only 34% of small businesses successfully stopped an attack before data encryption or extortion took hold, sharply contrasting with the 46% success rate reported by large organizations with thousands of employees.

The vulnerability in the system is clear: whether an organization is large or small, a ransomware incident can be devastating. Yet, where the focus must shift is from reactive payment to proactive defense. Sophos advises that businesses must invest heavily in advanced email protection, rigorous user awareness training, and robust access management protocols to secure their foundations against these ever-evolving threats.