Hornetsecurity by Proofpoint has launched its ‘Ransomware Report 2027’, finding that organizations are better prepared for ransomware attacks than ever before and that the proportion of organizations reporting a ransomware attack has fallen to around 18%, down from 24% in last year’s report.
Key ransomware protection measures are now firmly established across many organizations, with 84% having a disaster recovery plan, up from 82% in last year’s report, and 91% protecting backup storage against ransomware. In addition, 84% of organizations now provide security awareness training, up ten percentage points from 74% last year.
However, despite the widespread implementation of protective and recovery measures, almost half (45%) of those surveyed aren’t confident in the effectiveness of their organization’s own ransomware protection strategy.
Phishing remains the primary vector of entry
Attack vector responses show that email or phishing remains the primary vector of ransomware entry. Among respondents whose organizations have experienced a ransomware attack, 52% cite email or phishing as the attack vector, up from 46% in the previous report. Compromised endpoints follow in second place at 27%, virtually unchanged; 7% cite exploited vulnerabilities.
The prevalence of phishing highlights the importance of employee awareness in ransomware defence.
Fewer ransomware victims pay the ransom
Among those surveyed whose organizations have already experienced a ransomware attack, only around 3% state that a ransom was paid to recover their data. This low proportion underlines the importance of reliable recovery options. Protected backups and effective recovery processes can help organizations access intact data and resume operations following a successful attack, negating the need to pay ransoms.
AI raises the bar for ransomware defence
Deception tactics that staff need to be prepared for are evolving. This is particularly evident when looking at generative AI: 84% of respondents state that GenAI has heightened their organization’s concerns about cyber attacks and ransomware, while only 9% believe their staff would be able to reliably recognise an AI-generated phishing or identity spoofing attempt.
The results reveal a significant gap between awareness of AI-related risks and confidence in employees’ ability to recognise such deception attempts.
Ransomware protection must keep pace with attacks
The ‘Ransomware Report 2027’ paints a nuanced picture overall: the incidence of attacks has fallen compared with the previous report, and basic protective measures are widely in place. Phishing and compromised endpoints remain relevant attack vectors, while generative AI poses new challenges for the detection of deception attempts.
Email security, employee awareness, identity and endpoint protection, as well as backup and recovery, must work together. These measures can help organizations prevent and detect attacks early, respond quickly when incidents occur, and restore operations reliably.
About the study
For the ‘Ransomware Report 2027’, Hornetsecurity by Proofpoint surveyed 400 IT and cyber security experts on their experiences with ransomware, as well as their organizations’ protection and recovery measures. The study is Hornetsecurity’s sixth annual ransomware survey and took place in July and August 2026.
Resilience Forward comment
For business continuity and resilience professionals who have spent years making the case for investment in protected backups, disaster recovery, and exercising, these findings are genuinely welcome news. Seeing the proportion of affected organizations paying ransoms drop to around 3% – alongside 91% protecting backup storage and 84% maintaining disaster recovery plans – provides a compelling justification for sustained investment in business continuity management. When organizations struggle to quantify the ROI of resilience, this is a clear, board-level proof point: well-rehearsed recovery capabilities and intact backups give leaders the operational confidence to refuse extortion demands and restore services on their own terms.
