Semperis has published the results of a global ransomware study of nearly 1,000 IT and security professionals at organizations spanning multiple industries across the US, UK, France, and Germany. The study aims to understand the prevalence, frequency, and costs of ransomware attacks—in both ransom payments and collateral damage.
The results show that recovery time objectives (RTOs) are not being met: 49% of respondents needed 1 to 7 days to recover business operations to minimal IT functionality after a ransomware attack, and 12% needed 7 days or more.
The study also highlights an alarming trend toward multiple, sometimes simultaneous attacks, forcing business leaders to re-evaluate their cyber resilience strategies to address common points of failure, including inadequate identity system backup and recovery practices.
Other key findings include:
- Ransomware attacks are not a one-time threat: 74% of respondents that were attacked for ransom in the past 12 months were attacked multiple times—many within the span of a week.
- Companies are not prepared to beat ransomware: 78% of targeted organizations paid the ransom: 72% paid multiple times, and 33% of those paid ransom four times or more.
- Few companies see an alternative to ransom payment: 87% of attacks caused business disruption — even for those that paid ransoms —including data loss and the need to take systems offline. For 16% of respondents, the attack created a life-or-death dilemma.
- Paying ransom does not guarantee a return to normal business operations: 35% of victims who paid ransom either did not receive decryption keys or received corrupted keys.
- Although 70% of respondents said they had an identity recovery plan, signalling strong progress towards IAM-centric security, only 27% reported having dedicated, AD-specific backup systems. Without AD-specific, malware-free backups and a tested, cyber-specific recovery plan, recovery will be prolonged, increasing the chance that the organization will decide to pay ransom to restore business operations.
For management and the Board to make an educated decision not to pay ransom, they need to know how long recovery will take and have confidence in the process. That means you must test your plan in as close to a real-world scenario as possible and present it to the Board before an attack occurs. That way, when disaster strikes, decision makers will have been confident in their ability to say ‘no’ to attackers.
Mickey Bresman, CEO, Semperis
Of the ongoing cybersecurity challenges that organizations cited, lack of support from the board of directors topped the list. Other concerns included budget constraints, staffing shortages, outdated systems, and cybersecurity regulations and directives.
