The State of Ransomware 2025
3,400 organisations hit by ransomware
share their real-world experiences
3,400 organisations hit by ransomware
Ransomware still disrupts operations and drains budgets.
The latest data shows recovery is improving and payments are trending down — yet exploited gaps remain common.
Who benefits from these insights?
- Light environments: Small teams focused patching, MFA, secure e-mail, end-points.
- Moderate complexity: Mid-sized firms focused on monitoring, identity hygiene, segmentation, tested back-ups.
- High complexity: Enterprises that are focused on 24/7 detection, playbooks, immutable back-ups, recovery rehearsal.
- Board & leadership: Executives focused on risk factors, continuity goals, evidence-based investment.
To access the full report, complete the form below and receive instant access to the latest ransomware stats.
Built for business decisions
When you download our free report, you’ll learn how the cause and consequences of ransomware in thousands of organisations across 17 countries have evolved over the past six years. You’ll also discover insights from brand new research areas in 2025:
- The operational factors that led organisations to fall victim to attacks.
- Why 53% pay less than the initial ransom demand – and 18% pay more.
- The human impact of incidents on IT/cybersecurity teams.
Snapshot of the findings
- 32%attacks began via exploited
vulnerabilities - 97%of victims with encrypted data
recovered it - $1Mmedian ransom paid
(payments down year-on-year) - $1.53Mavg. recovery cost (excl. ransom),
down from $2.73M
Turn insight into action.
Use the latest ransomware evidence to prioritise patching, identity controls, monitoring, and recovery readiness.
Industry Partners
Northbound Networks collaborates with leading technology partners to deliver best-in-class solutions to our clients. Our strategic partnerships with industry leaders ensure that we have access to cutting-edge technologies and resources to address your business needs.
