No, paying ransom is almost never cheaper. Organizations that recover from backups spend a median of $375,000, while those paying ransom average $3 million in total costs. Ransom payments themselves average $2 million, and attackers don’t guarantee functional data recovery even after payment. (Totalassure.)
Pithy Security | Cybersecurity FAQs – The Details
Question: Is paying ransomware attackers actually cheaper than recovering from backup?
Asked by: Perplexity AI
Answered by: Mike D (MrComputerScience) from Pithy Security.
The Math Destroys The Ransom Argument
Sophos research covering 3,000 ransomware incidents shows organizations with intact backups face median recovery costs of $375,000. Those who pay ransom face $3 million in total costs, eight times higher. This isn’t just the ransom payment itself. It includes downtime (averaging 21-24 days), lost revenue, system rebuilding, incident response, legal fees, and regulatory fines. Even the ransom payment alone averages $2 million when backups are compromised. (Security Boulevard.)
Organizations that maintained offline backups reduced recovery costs by 44% compared to ransom payers. Recovery time dropped to 12 days versus 24 days for ransom scenarios. The 2025 data shows only 49% of attacked organizations paid ransoms, down from 56% in 2024, specifically because backup reliability improved. When backups work, they’re dramatically cheaper and faster than negotiating with criminals who have zero incentive to honor agreements. [TotalAssure]
Attackers Know Backups Kill Their Business Model
94% of ransomware attacks now include attempts to compromise victim backups. In government and entertainment sectors, this hits 99%. Attackers specifically target backup servers, snapshot repositories, and cloud backup accounts because they know functional backups eliminate ransom leverage. When they succeed in corrupting backups, encryption rates jump to 85% versus 52% when backups remain secure.scworld+1
This backup sabotage changes the economics entirely. Ransom demands double to a median of $2.3 million when backups are compromised versus $1 million when they’re intact. Payment rates jump from 36% to 67%. Victims also lose negotiating power, paying 98% of demands versus 82% when backups work. Criminals understand the financial pressure of extended outages. They just need to make backup recovery seem impossible or slower than paying.[Sophos]
Recovery Speed Depends On Backup Architecture
Traditional tape or daily backup systems create the illusion that ransom is faster. Restoring terabytes from nightly backups takes weeks. Identifying clean restore points when malware lurked undetected for months adds complexity. Manual reconfiguration of servers and applications extends timelines further. This is where the “ransom is cheaper” myth originates, but it’s an infrastructure problem, not an inherent backup limitation.
Organizations using immutable snapshots with frequent intervals (hourly or continuous) recover in hours, not weeks. Snapshot-based systems provide instant rollback to pre-attack states with minimal data loss. Air-gapped or offline backups prevent attacker access entirely. Organizations that test quarterly backups recover three times faster than those who never validate restoration procedures. The difference isn’t backup versus ransom. It’s tested, modern backup architecture versus neglected legacy systems that only get validated post-breach.securityboulevard+1
What This Means For You
- Implement immutable backup snapshots taken hourly rather than daily backups to enable recovery within hours instead of weeks after an attack.
- Store backups offline or air-gapped from production networks so ransomware cannot access or encrypt backup repositories during an attack.
- Test backup restoration quarterly on critical systems because untested backups fail 30-40% of the time when organizations actually need them.
- Calculate total downtime costs at your current revenue rate to prove backup investment ROI versus the $3 million median cost of ransomware recovery.
Related Questions
- 1
- 2
- 3
Want Cybersecurity Breakdowns Like This Every Week?
Subscribe to Pithy Security (Cybersecurity news made simple. No ads. No hype. Just signal.)
Subscribe (Free) → pithysecurity.substack.com
Read archives (Free) → pithysecurity.substack.com/archive
You’re reading Ask Pithy Security. Got a question? Email ask@pithysecurity.com (include your Substack pub URL for a free backlink).