State and local government reported the highest median ransom payment at $2.5 million.

In 71% of cases where companies paid a smaller ransom than the initial demand, negotiation played a role, either directly or with third-party assistance.

35% of respondents cited ransomware as a top concerning threat.

For the third year in a row, exploited vulnerabilities were identified as the number one technical root cause of ransomware attacks.

Only 18% took more than a month to recover from a ransomware attack, down from 34% in 2024

The median ransom demand decreased by a third between 2024 and 2025.

Data encryption was at a six-year low, with only half of companies having their data encrypted in a ransomware attack.

40% of ransomware victims stated that adversaries exploited a security gap they were unaware of, highlighting issues with attack surface visibility.

44% of companies were able to stop the ransomware attack before data was encrypted, marking a six-year high.

Over half (53%) of organisations fully recovered from a ransomware attack in a week, up from 35% last year.

Organisations with $250 million revenue or less saw median ransom demands of less than $350,000.

Overall, 63% of organisations cited resourcing issues as a contributing factor to falling victim to a ransomwre attack.

Only 54% of companies used backups to restore their data after a ransomware attack, which is the lowest percentage in six years.

Nearly 50% of companies paid a ransom to recover their data, which is the second highest rate of ransom payment for demands in six years.

The median ransom payment dropped by 50% from $2 million in 2024 to $1 million in 2025.

Healthcare reported the lowest median ransom payment at $150,000.

Companies with over $1 billion in revenue faced a median ransom demand of $5 million.

53% of companies that paid the ransom successfully negotiated a lower amount than the initial demand.

The median ransom payment was $1 million.

35% of respondents cited ransomware as a top concerning threat.