2024

Ransomware
and Data Extortion
Business Risk Report

Ransomware operators set numerous
records in 2023 and extorted morethan $1 billion in payments from victim
organizations. The overall volume of
attacks surged by 55.5% year-over-yearwith at least 4,368 documented cases.

1|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

2

In the second quarter of 2024 Halcyon surveyed 913
US-based cyber security decision-makers and practitionerson their experiences with ransomware since 2022.

21% of victims said operations were disputed for more than 6months, while 18% said systems were down for 2-4 months, and
24% said disruptions lasted 2-4 weeks.
Nearly two-thirds said that sensitive or regulated data was
exfiltrated in the attacks and nearly the same number said
an additional ransom demand was made to protect that data,
and that data loss put their organizations at additional risk of

Security teams remain confident in both their ability to prevent

regulatory action or lawsuits.

and quickly recover from a ransomware or data extortion attack.
Yet in every in major ransomware attack that’s been made public,

59% of respondents indicated the total cost for network

the victim’s security controls were bypassed, evaded or otherwise

remediation (incident response only) cost their organization morenegated by the attacker’s tactics, techniques and procedures.

than $1 million.

Halcyon recently surveyed 913 Director-level security and IT

Of the organizations that opted to pay a ransom demand, theprofessionals at North American organizations that were targetedmajority (78%) said the attackers failed to provide a working

by ransomware operators in the previous 24 months.

decryptor or data was corrupted upon decryption.

The survey results indicate that there is a disconnect between

All of the participants indicated their organizations were running

perception and reality when it comes to preparing for andsome combination of prevention tools including AV, NGAV, EDR,

responding to ransomware or data extortion attacks. Additionally

XDR, and/or DLP when they were victimized in a successful

malicious data exfiltration continues to put companies in legal andransomware attack.

regulatory jeopardy, while disruptions to production environments
are prolonged and costly.
Key findings in this study include:
More than 22% said their organization was targeted withransomware ten times or more in the last 24 months. 56% ofremaining participants stated they were targeted between
two and nine times in the same time period.

encryption or destruction by attackers, and restoration from backups
is an arduous manual process that can take weeks or months.
The findings of this study make it clear that organizations are overly
confident in their ability to defend against and quickly recover fromransomware attacks, that data exfiltration is becoming nearly as
big of a problem for victim organizations as the actual ransomware

could disrupt an attack before ransomware is delivered.

payload, and that the cost of recovery can far exceed expectations.

could quickly resume regular operations following a
successful attack.

|mechanism despite the fact backups are often targeted for

88% were somewhat or very confident their organizations
85% were somewhat or very confident their organizations

3

Nearly four-in-five said that data backups are the primary recovery

The C-suite and Boards of Directors need to understand thatransomware attacks continue to be one of the biggest threats facing
every organization across every industry vertical, that even the mostDespite this confidence, nearly one-in-five said the attacks

robust security deployments are being bypassed by ransomware

resulted in 10 or more ransomware infections, an equal

operators, and that data loss in the course of a ransomware attack

number saying they were targeted 5-9 times, and nearly one-can put them in legal or regulatory jeopardy and end up being a bigger

third stating they were infected 2-4 times.

issue than the attack itself.

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

4Security Deployments
Ransomware attacks are making headlines daily.

Almost daily we see large organizations with

One thing every major ransomware incident

robust security programs get hobbled by

has in common: the attacks evade or get aroundransomware attacks. It is demonstrative of

traditional security controls.

the fact that, even if an organization has ample

Legacy security tools, while necessary andeffective in neutralizing a large amount of
threats, were simply not designed to address theunique threat that ransomware presents. This is
why we continue to see destructive ransomware
attacks impact organizations in new ways.

resources to stand up a security program, it
takes the exploitation of just one unpatchedvulnerability to bring them to their knees, as wesaw repeatedly in the mass exploitation of the
MOVEit and GoAnywhere file transfer software.
Organizations cannot simply focus on deploying
preventative technologies or data backups
and expect that to be enough. Threat actors
have proven repeatedly that they can easily
circumvent a variety of security controls.

Even if an organization has a mature security program,it takes the exploitation of just one unpatchedvulnerability to bring them to their knees.

5|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

6In this study, respondents indicated their organizations wererunning a variety of security solutions, either as stand-alone
or alongside other solutions. Nearly half of respondents
indicated their organizations had Traditional Antivirus(47%), Next-Gen Antivirus (47%), or Endpoint Detection andResponse (45%) solutions deployed on their networks.
More than one-third indicated their organizations had
Extended Detection and Response (42%) and Data Loss
Prevention (42%) solution deployed, while less than onethird had a Anti-Ransomware Solution (30%) deployed.

Which types of security
solutions were deployed?
Traditional Antivirus

47%

Next-Gen Antivirus (NGAV)

47%

Endpoint Detection and Response (EDR)
Extended Detection and Response (XDR)

42%

Data Loss Prevention (DLP)

42%

Anti-Ransomware Solution

7|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

45%

30%

8

Just about one-in-ten were unsure of the effectiveness of theirsecurity stack (8%), while just a fraction (4%) lacked confidence
attacks could be disrupted before data/systems were encrypted.
Furthermore, if an attack were to be successful and a ransomware
payload was delivered resulting in a network infections, themajority of respondents (85%) felt “very” (58%) or “somewhat”(27%) confident their organizations could quickly resume regular

What is the confidence levelin the security stack?
Given the significant investments

Very confident

operations, while just a fraction (4%) indicated they were notSomewhat confident

confident their organization could quickly recover from an

Uncertain

infection, with about one-in-ten (11%) saying they were unsure.

Not very confident

their organizations have made in their

On average, a ransomware attack takes 237 days to detect andrespective security programs, the89 days to fully remediate (PDF). While some organizations may

majority of respondents (88%) werebe able to withstand lengthy disruptions to some systems, for“very confident” (61%) or “somewhat

sectors like manufacturing and retail where losses are measured

confident” (27%) their security apparatus

in minutes, this level of disruption could be catastrophic andcould disrupt an attack before therepresent an existential event. For healthcare providers theransomware payload was delivered andimpact has been shown to negatively impact patient outcomes anddata/systems encrypted.

potentially result in premature deaths.

As you will see below, there is a

How confident are you thatcurrent security deployments
can stop a ransomware
attack before infection?

significant disconnect between survey
respondents’ confidence that theirsecurity programs are prepared todetect and disrupt a ransomware
attack - and that their organizations

61%
27%
8%
2%
2%

61+27+82z
Not confident at all

could quickly recover from a
successful attack - and the numberof attacks on their organizations
that actually resulted in an infection
by a ransomware payload, major
disruptions to operations, and costly
remediation efforts.

2% 2%

8%

27%

There is a significant disconnect between confidence
in security programs and the ability to actuallydetect and disrupt a ransomware attack before
data is exfiltrated or an infection occurs.

9|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

61%

10

Ransomware
Attacks
Ransomware is no longer considered a boutiquethreat, but rather one of the most significant
threats to any organization. Recent researchfound that ransomware attacks surged by an
alarming 55.5% in 2023, and the vast majority(75%) of organizations reported being targetedby at least one ransomware attack in the last 24
months, with 26% reporting they were targetedby ransomware operators four or more times.

11|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

12

22+23+33175z

How many times was your organization
attacked in last 24 months?
Attacked 10 times or more
Attacked 5 - 9 times
Attacked 2 - 4 times
Attacked just once
Attacked, but unsure
how many times (?)

22%
23%
33%
17%
5%

?

1

2-4

In this study, about one-in-five respondents (22%)
indicated their organization was targeted byransomware operators a staggering ten times or morein the last 24 months, while nearly one-in-four (23%) said
they were targeted five or more times.
One-third (33%) of respondents were targeted twotimes or more, and about one-in-five indicated theirorganization was targeted just once or were unsure
how many times they were attacked.

About one-in-five respondents
indicated their organization
was targeted by ransomware
operators a staggering ten times
or more in the last 24 months.

13|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

10+How many attacks resulted
in ransomware infection?
Infected 10 times or more
Infected 5 - 9 times
Infected 2 - 4 times
Infected just once
Never infected

18%
18%
30%
22%
12%

5-9

How many attacks were successful?
Of the organizations that were targeted byransomware operators, nearly one-in-five (18%)
indicated the attack resulted in the encryption ofdata/systems ten or more times, and the same
number of respondents (18%) indicated the attack
resulted in encryption more than five times.

18+18+302212z
0

10+

1

5-9

2-4

Nearly one-third (30%) indicated data/systems wereToday’s more complex ransomware and dataencrypted on at least two occasions, and just overextortion operations are multi-staged attacks where

one-fifth (22%) indicated just one successful infection.

the threat actors are looking to infiltrate as much ofMore than one-in-ten (12%) of respondents said thatthe targeted network as possible while exfiltrating

they were targeted by ransomware operators but

sensitive data along the way to be used as leverage.

never infected.

Unfortunately, most organizations are unaware

As we can see from the contrast, while confidence isthey are the victim of a ransomware attack until thehigh that ransomware attacks can be detected andencryption payload and ransom note are delivered,blocked before delivery of the ransomware payload

which are the tail-end of the larger ransomware

and subsequent encryption of data and systems.

operation.

14

Business Impact
There are several statistics available for the average operational
downtime resulting from ransomware attacks, with the average
being about three to three and a half weeks. Yet in this study,
shockingly half of respondents (50%) indicated that a ransomware
attack disrupted business operations at their organization for amonth to more than half a year.

15|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

16

How long were business operations disrupted?

How much were incident response costs (IR only)?

Specifically, one-in-five (21%) said operations were disrupted for 6

In this study, 59% of respondents

months or more, while nearly as many said disruptions lasted 2-6

indicated the total cost for remediation

months. About one-in-ten (11%) said disruptions lasted for about(incident response only) cost their

one month, while only about one-in-five (21%) said disruptionsorganization more than $1 million,

lasted one or more weeks, and only about one-in-seven (14%) said

one-in-ten (11%) said incident response

they resolved disruptions in a matter of days.

costs ran about $500,000 — $999,999,
and less than one-in-ten (8%) said

Research indicates that remediation costs following a

21+18+1113895123z

between $100,000 — $499,999.

targeted organizations. This figure does not include additional

incident response costs or tangential costs like damage to theJust about one-in-six (16%) said incident

brand, lost revenue, or lost production from downed systems.

response cost less than $100,000.

A few
hours

6+
months

1 day

SeveralDays

2-6months1 week

2-3
weeks

17

|

1
month

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

59%$500k – 999k
$100k – 499k

11%
8%

remediation cost their organizations

ransomware attack average more than $4.5M per incident for

?

$1M+

$50k–99k$20k–49k

4%
5%

Collateral damage from ransomware
attacks can include loss of intellectual

Under $20k

7%

property, loss of consumer trust,increased cyber insurance premiums,

Over 6 months
2-6 months
1 month
2-3 weeks
1 weekSeveral days
One day
A few hours
Uncertain (?)

21%
18%
11%
13%
8%
9%
5%
12%
3%

legal liability, and lost revenue, all of

Unknown6%

which can far exceed remediation costs.

Fifty-nine percent (59%) of participants
indicated remediation (incident response only)
cost their organization more than $1 million.

18

57+33+10z

What were the estimated total losses?

Will there be long-term impact on the organization?

About one-third of respondents inIn this study, more than half (57%) of

our study (32%) said total losses to

32%

$10M+

have or will hurt our organization in thethe organization from the costliest
ransomware attack exceeded $10$5 – 9M

13%

long-term, while one-third (33%) believed
there would be no long-term impact tomillion. More than one-quarter (28%)
said total losses to the organization
ranged between $1-$9 million and less15%

$1 – 4M

than one-fifth (18%) said losses ran
between $1,000,000 and $999,999,$500k – 999k

9%$100k – 499k

9%while a nearly equal number (17%) said
total losses following a successful
attack were below $100,000.
Ransomware attacks can have lasting

profitability, or overall viability of theorganization.

the organization and one-in-ten (10%)
were unsure.
This, of course, again runs counterto the levels of confidence from
respondents for both the capability
to detect and disrupt an attack andthe ability to swiftly recover from a$50k – 99k

5%

successful attack reported above,
highlighting the disconnect between

impact, negatively impacting longterm operations, competitiveness,

respondents said ransomware attacks$20k – 49k< $19kUnknown

perception and real-world outcomes.

5%
7%
5%

Unsure
10%

No
33%

Yes
57%

More than half (57%) of respondents
said ransomware attacks have or will
hurt our organization in the long-term.

One-third of respondents in our study (32%) said
total losses to the organization from the costliest
ransomware attack exceeded $10 million.

19|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

20

Data Exfiltration
Data exfiltration occurs when a threat actor engages in an
unauthorized data transfer from a computer, server, or othernetwork system without the consent of the system’s owner.
The types of data threat actors exfiltrate typically include thepersonally identifiable information of clients or employees,
information related to payment processing, the organization’s
business dealings, trade secrets, and intellectual property, andother data the attacker can leverage for tactical or financial gain.
Data exfiltration and the threat of exposure are now a central
aspect of nearly every ransomware operator’s playbook andsignificantly increase the chances for the extortion efforts to be
successful.
The double extortion tactic begins when they exfiltrate sensitive
information from the target before launching the encryption
routine. The threat actor then makes the additional demand thatvictims pay up to prevent the attackers from publishing theirdata online.

21|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

22Was sensitive or regulated
data exfiltrated?
In this study, nearly two-thirds of respondents(60%) indicated that sensitive or regulated data was
exfiltrated by ransomware operators, while less than
one-third (30%) said no data was lost and one-in-ten(11%) were unsure of any data was exfiltrated.
In many cases, attackers may not only demand
payment of a ransom to regain access to encrypted
systems, but they may also demand further payment
for the stolen data itself. And of course, there is no
guarantee that payment will protect the stolen datafrom being exploited.

60+29+11z
55+33+12z
Unsure
11%

No
29%

Yes
60%

Was additional ransom payment required for exfiltrated data?
Of the organizations who said data was exfiltrated
by ransomware operators, more than half (55%) said
the attackers required an additional ransom payment
for the data in addition to the ransom demanded toprovide a decryptor to recover data/systems.
Fully one-third (33%) said the attackers only
demanded one ransom payment for the decryptor andassurance the exfiltrated data would not be exposed,
while about one-in-ten (12%) were uncertain whether
an additional ransom payment was demanded toprotect or recover the exfiltrated data.
Ransomware operators are more often threatening
to publish or sell stolen data if the ransom is not
paid. This can lead to regulatory fines, legal liability,
and severe damage to the company’s brand andcustomer trust.
The number of class action lawsuits spurred byransomware attacks that include data exfiltration

23|

has skyrocketed in the last two years, and liability

risk is also specifically hitting the C-suite and Boardsof Directors. Even if organizations are prepared torespond and recover from a ransomware attack, theDid exfiltration result in
regulatory or legal risk?
Of the organizations who said data was exfiltrated
by ransomware operators in this study, more thanhalf (58%) indicated the exfiltration of sensitive
data put their organization at additional legal andregulatory risk.
One-third (33%) said they did not believe theexfiltration of data put their organization atadditional legal and regulatory risk, while less than
one-in-ten (9%) were uncertain if the exfiltration ofdata put their organization at additional legal andregulatory risk.

More than half (58%) indicatedthe exfiltration of sensitive data
put their organization at additional
legal and regulatory risk.

58+33+9z
Unsure
9%

No
33%

Yes
58%

fact that sensitive data was stolen or exposed puts
them at additional liability risk.

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

Unsure
12%

No
33%

Yes
55%

24

Recovery
The targeting of data backups, whether
stored on-site or in the cloud, has
increasingly become a favored tactic ofransomware attackers. Today’s attacks
typically include the exfiltration of sensitive
data, so even if systems can be restored
without having to pay the ransomware
operators for a decryption key, there
is no guarantee that a ransom payment
will prevent the stolen data from being
exploited.
This challenge is further complicated by acommon tactic where the attackers use
legitimate network tools like the Windows
VSSadmin process to delete shadow copy
backup files.

25|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

26

Are data backups as primary means of recovery?
This study found that the vast majority of respondents

Data backups are still highly recommended forindicated their organizations depend on data backup

disaster recovery, but organizations cannot depend

solutions as the primary recovery mechanism foron them as the primary means of recovering from aransomware attacks (78%), while about one–in-sevensuccessful ransomware attack.

(15%) said their organizations did not depend on data
backups, and a fraction (7%) were uncertain what
their organization planned to use to recover from aransomware attack.

Organizations need to also understand that paying the

If ransom paid, did the attackers
provide a working decryptor?
Yes, the key restored systems to normal
Yes, but only on partially restored systems
No, the key did not restore systems

ransom does not guarantee that data and systems

Unsure (?) if the attacker supplied a valid key

will be restored, and there are numerous cases

My organization did not pay a ransom

where a ransom was paid, and key received, but the

It is increasingly likely that ransomware operators

data was corrupted during decryption. Also, even

Nearly one-fifth of respondents in this study (18%) said

will wipe backups during the attack, so backups have

if all is restored, paying the ransom may result intheir organization refused to pay a ransom demand.

limited utility regarding ransomware attacks. Even

further attacks.

Of the organizations that opted to pay a ransom

when uncorrupted backups are available, restoration

demand (82%), less than half (47%) said the attackersof every infected device is an arduous task involving aprovided them with a encryption key that restored

78+15+7z
manual wiping and re-imaging process that can takedata/systems to normal, while nearly one-third (31%)

weeks or months, and at great cost.

said the attacker provided an encryption key but it

?
7%

No
15%

Yes
78%

27

|

only partially restored systems or did not work at all.

47%
23%
8%
4%
18%

47+23+8418z
Didn’t pay
18%

Unsure
4%

Yes
47%

No
8%

Partial23%

The vast majority of
respondents indicated theirorganizations depend on
data backup solutions as theprimary recovery mechanism
for ransomware attacks (78%).

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

Of the organizations that opted
to pay a ransom demand,the majority (78%) said theattackers failed to provide a
working decryptor or data wascorrupted upon decryption.

28

CyberInsurance
As it stands, insurance companies have not been able
to put their finger on the magic equation that allows foraffordable policies for both the insured and the insurer.
Ransomware attacks vary in severity, and ransom
demands range from tens of thousands to tens of millionsof dollars.
Furthermore, organizations may handle different kindsof sensitive data that put them in different liability
categories, and they may use a wide range of security
solutions, each filling one small gap in protection, all ofwhich need to work together to prevent a disruptive
event. This is a complicated ecosystem for insurers
to cover.

29|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

30

Did cyber insurance cover the incident response costs?
Yes, cyber insurance covered the cost of recovery from the attack(s)Yes, but cyber insurance only covered a portion of the cost of recovery
No, cyber insurance did not cover recovery costs

My organization does not carry cyber insurance

In this study, of the organizations that do have a cyber
insurance policy in place, less than half of respondents
indicated (41%) said their organization’s cyber
insurance policies covered the incident response
costs, while one-in-five (19%) said their policies only
covered some of the costs of remediation and afraction (5%) said their policies did not cover any of
the remediation costs.
Policy holders are facing more restrictive policies
with add-ons for covering ransomware-related losses,
more comprehensive audits of security controls, andever-increasing premiums, while insurance providers
are facing a crunch on pricing the policies accurately
to cover the losses they see in the real-world, which
are continuing to grow.

41%
19%
5%
4%
31%

Not
insured

Yes
41%

No
5%

Partially19%

It has been observed that most victims who paid a

Then there is the debate over whether to pay ransom

payment of more than $1 million orOver $1M+

50%$500k – 999k
$100k – 499k

16%
12%

ransom demand were attacked again, often by thesaid ransom demands ran between$100,000 and $999,999, while half
as many (14%) indicated the ransom
demands were less than $100,000.
Many organizations consider or havealready purchased cyber insurance
policies to cover the cost of a

$50k – 99k

5%cyberattack or data breach event. The

31%

?
4%

attackers demanded a ransom
more. More than one-quarter (28%)

41+19+5431z

Unsure (?) if cyber insurance covered recovery costs

50% of participants indicatedWhat was the highest
ransom demand?

increased risk of ransomware attacks$20k – 49k< $19kin recent years had made cyber

5%

insurance even more appealing. But
today most insurers no longer cover4%

all potential losses from ransomware
attacks, and those that do have

Unknown8%

increased premium costs.
Insurers simply do not know how toquantify the risk from ransomware
accurately to set premiums. Whether
or not cyber insurance is the right
instrument for organizations when
considering the impact of ransomware
attacks is in question.

demands, which has become a contentious issue

same threat actor who demands a higher ransom

For cyber insurance policies that do

among experts. The simple answer would seem to be

payment knowing the victim is likely to pay. The

offer ransomware coverage, many

that organizations should never pay a ransom demand,

average ransom demand 2023 was $5.3 million, and inwill no longer cover the ransom

which would significantly diminish the financial

this study fully half of the respondents (50%) indicatedpayment — they can vary too wildly,

incentives for these attacks. In many circumstancesthat ransomware operators demanded a ransom

so it is too hard to define actuarially.

that might be the logical approach, but it may not be

payment of more than $1 million or well into the tens-

Only after a ransomware attack hits

the right approach for every organization.

of-millions of dollars.

an organization do they find the policy
will only cover a fraction of the costs/
losses/remediation.

31|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

32

Did cyber insurance cover the ransom demand?
33%
15%
6%
5%
41%

Yes, covered the ransom
Yes, but only a portion
No, did not cover ransom

My organization does not carry cyber insurance

demand, one-third indicated cyber insurance covered
the full ransom demand, while about one-in-seven(15%) said the policies only covered a portion of
the ransom demand, and a fraction (6%) said cyber
insurance did not cover any of the ransom demand.
Cyber insurance is not always a viable option for allorganizations, and it is certainly not for companies
who think they can indemnify instead of investing insecurity. For a policy to be in force, the organizationneeds to have an extensive accounting of its
security program.
If and when the time comes to submit a claim, if theorganization is out of compliance — for example, if it did
not apply patches in a timely manner or misconfigured
security applications – they may be disappointed tofind that their policy does not cover the attack.

Yes, premiums increased slightly
No, premiums remained same

Yes
33%

Not
Insured

41%

Partially
15%

?
5%

39%
28%
8%
5%
20%

Yes, premiums increased significantly

33+15+6541z

Unsure (?) if cyber insurance covered the ransom demand

In this study, of the organizations who paid a ransom

Have premiums increased in the past 24 months?

No
6%

Unsure (?) if premiums changed

39+28+8520z

My organization does not carry cyber insurance

In this study, of the organizations who have cyber
insurance policies, nearly two-in-five (39%) said
their premiums increased significantly following a
successful ransomware attack, while more than onequarter (28%) said their premiums increased slightly.
Less than one-in-ten said their premiums stayed about
the same following a ransomware attack.

Not
Insured

20%

Yes
39%

?

No
8%

Slightly
28%

Furthermore, ransomware attacks vary in severity,
and ransom demands range from tens of thousands

According to the Insurance Journal, cyber insurance

to tens of millions of dollars. Insurance customers

premiums jumped 50% in 2022 due to the surge inare facing more restrictive policies with add-ons

ransomware attacks and tripled over the previous

for covering ransomware-related losses, more

three years. As well, Beta News reported thatcomprehensive audits of security controls, and ever-insurance provider Coalition reported a 12% spikeincreasing premiums, while insurance providers arein cyber insurance claims related to ransomware

facing a crunch on pricing the policies accurately to

attacks over the first six months of 2023, withcover the losses they see in the real-world, which areorganizations having over $100 million in revenue

continuing to grow.

seeing the largest increase (20%).

33|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

Nearly two-in-five (39%) said theirpremiums increased significantly following
a successful ransomware attack.

34

Takeaway
More focus needs to be placed “left of boom” — atinitial ingress, command and control (C2), lateral
movement, data exfiltration, and so on. If we aredoing our jobs right and disrupt an operation atthese earlier stages, then we would not evenknow it was a ransomware attack, just anotherintrusion event.
As well, there is not enough focus on what comes
after “boom” — how the organization can plan for
the failure of security controls and be positioned
to respond efficiently and effectively to a future
ransomware attack, making the organization andits operations as resilient as possible by reducing
the potential for mass disruption.
The findings of this study demonstrate thatorganizations are overly confident in their ability
to defend against and quickly recover fromransomware attacks, that the risk from data
exfiltration is not being adequately addressed byorganizations, and that the cost of recovery can
far exceed expectations.
The C-suite and Boards of Directors are
increasingly at risk from lawsuits and regulatory
actions due to the exfiltration of sensitive
data as even the most robust of security
programs continue to be routinely bypassed byransomware operators.

35|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

36

Achieving cyber resilience requires more than just robust
cybersecurity measures; it demands a comprehensive
understanding of an organization’s preparedness towithstand and rebound from cyber incidents. Central
to this endeavor is the strategic selection and diligent
monitoring of key performance indicators (KPIs) andmetrics tailored to assess cyber resilience effectively.
Here are some of the essential metrics that can
assist in bolstering organizational resilience:

Incident Response Plan Effectiveness:
Assess the effectiveness of the incident response plan bymeasuring how well it is followed during a cyber incident, including
factors like containment time, communication effectiveness, andcoordination among response teams. In order to have an effective
cyber resilience strategy it is key that an organizations responseplans are effective and followed, if the plan is not being followed
it can lead to an increase in the time required to respond andeffectively mitigate the issue. Evaluate whether the plan needs
to be changed to address changes in the threat landscape, riskthemselves, or the organization response.

Cybersecurity Training and Awareness:
Measure the effectiveness of cybersecurity training programs by

Mean Time to Detect (MTTD):
This measures how long it takes for an organization to detect acyber threat or incident. A lower MTTD indicates better detection
capabilities. MTTD is a key indicator that can be used to determine
whether an organization is properly prepared to respond to
threats in a timely manner. Lowering the MTTD can help containthe lateral movement within an organization and is an effective way
to reduce the potential impact spread in a breach.

Mean Time to Respond (MTTR):
This measures how long it takes for an organization to respondto a cyber threat or incident once it has been detected. A lower
MTTR indicates faster response capabilities. Once an incident has
been detected how quickly is an organization able to respond to
the event, in order to effectively lower this metric, consider theoutcomes of tabletop exercises and implementation of lesson
learned during incidents that should provide indications of area for
improvement in the response.

37|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

tracking metrics such as employee awareness levels, completion
rates of training modules, and performance in simulated phishing
exercises. At the end of the day cyber incidents often have at least
some if not a major human component. Evaluate the effectivenessof the training you are providing and the way it is provided. Oftenorganizations provide a “one size fits all” approach to cyber training
and awareness, this unfortunately misses the mark, a successful
approach for a developer will not address the same needs
for the CFO.

Cybersecurity Hygiene:
Track metrics related to cybersecurity hygiene practices, such as
the frequency of system patching, vulnerability scanning results,
and compliance with security policies and standards. Hygiene
should be table stakes for any organization trying to increase
their cyber resilience, however this is often not the case. Create aprioritized approach to address the hygiene issue. Avoid the pitfallof chasing the next new cyber solution until you have a successful
approach to address your organization’s cyber hygiene.

38

Cyber Risk Exposure:

Backup and Recovery Metrics:

Quantify cyber risk exposure by assessing the organization’s risk

Measure the effectiveness of backup and recovery processes

posture based on factors such as asset criticality, vulnerability

by assessing metrics such as backup success rates, recovery

severity, and threat likelihood. If you do not have a valid way totime objectives (RTO), and recovery point objectives (RPO). In an

measure your exposure, then you have little ability to identify

incident, can you get the data back? How long will recovery take?

where to prioritize your resources and increase your resilience.

Does it match the desired recovery window? This should be tested
and confirmed that the expectation meets real world results.

Third-Party Risk Management:
Track metrics related to third-party cyber risk, including theBusiness Continuity and Disaster Recovery Metrics:

number of third-party assessments conducted, the level ofBusiness Continuity and Disaster Recovery (BCDR) metrics

compliance with security requirements, and any incidents or

measure the organization’s ability to maintain operations during

breaches involving third-party vendors. In today’s interconnected

and after a cyber incident by tracking metrics such as recovery

world it is impossible to have any perspective on the resilience oftime objectives (RTOs), recovery point objectives (RPOs), and theyour organization if you can understand the risk that your third-

success rate of BCDR exercises.

party relationships and connections are introducing into theecosystem you operate in.

Effective cyber resilience requires a holistic approach thatincorporates proactive measures, rapid detection, efficient
response, and robust recovery mechanisms. By monitoring and

Security Controls Effectiveness:
Assess the effectiveness of security controls by monitoring
metrics such as intrusion detection/prevention system (IDS/IPS)

optimizing these key metrics, organizations can enhance theirability to withstand and recover from cyber threats, safeguarding
their operations and maintaining business continuity.

alerts, firewall rule effectiveness, and malware detection rates.

Lastly, think about how often the plan is tested and confirm

Are your controls effective? Should you be investing in otherdisaster recovery planning. Sometime this is outside of cyber, but

areas with potentially better ROI? Measuring whether you have

it is important to confirm that your plans can be implemented in a

implemented the right controls and are delivering the right results

true DR scenario and services remain available.

is important to consider.

39|

R A N S O M W A R E A N D D ATA E X T O R T I O N B U S I N E S S R I S K R E P O R T

40

The Halcyon Mission:
Defeat Ransomware
Halcyon is the cyber resilience platform that Global 2000 companies
rely upon to defeat ransomware-as-a-service attacks. With the fastest
endpoint recovery capabilities and multiple layers of resiliency that
includes bypass and evasion protection, key capture and automateddecryption and data extortion prevention, the Halcyon Anti-Ransomware
Platform reverses the impact of ransomware attacks in just minutes.
For more information on how Halcyon efficiently and effectively defeats
ransomware attacks, contact an expert here or visit halcyon.ai torequest a free consultation.

© 2024 Halcyon, Inc., Date published, June 26, 2024.