Cohesity Research: Majority of Companies Break ‘Do Not Pay’ Policies, Paying Millions in Ransoms

Cohesity’s recent research highlights that a significant number of companies are violating their ‘do not pay’ policies by succumbing to cyberattacks and paying ransoms. The study, based on responses from over 900 IT and Security decision-makers, underscores the prevailing reality that companies operate on the assumption of ‘when,’ not ‘if,’ when it comes to cyberattacks. The findings reveal that a majority of companies have paid ransoms over the past two years, with an alarming 79% admitting to falling victim to ransomware attacks between June and December.

The cyber threat landscape is anticipated to worsen in 2024, with 96% of respondents expecting an increase in cyberattacks compared to the previous year. Despite the growth in data environments, 78% of participants noted that their data security risk has outpaced data growth. Furthermore, organizations seem ill-equipped to deal with the evolving threat landscape, as only 21% expressed full confidence in their company’s cyber resilience strategy.

The study emphasizes the crucial role of cyber resilience in business continuity, revealing that all surveyed companies require over 24 hours to recover data and restore business processes following a cyberattack. Disturbingly, nearly one-fourth of respondents need more than three weeks for the recovery process. Additionally, a lack of regular testing of data security, management, and recovery processes is evident, with only 12% having stress-tested these systems in the six months preceding the survey.

Despite the existence of ‘do not pay’ policies, 94% of respondents admitted their companies would pay a ransom to recover data, and 67% were willing to pay over $3 million, highlighting the urgency in responding and recovering from cyberattacks.

The study suggests a need for increased executive awareness and accountability for data security, with only 35% stating that senior management fully understands the risks involved. Respondents highlighted concerns about brand damage, share price reduction, direct revenue loss, and stakeholder trust as top priorities in the event of a successful data breach or cyberattack.

Interestingly, despite government efforts to promote cybersecurity, only 46% of respondents believe that government initiatives drive their company’s data security, management, or recovery strategies. Organizations are urged to view legislation and regulations as a baseline rather than the sole framework for their data security practices. The research underscores the critical importance of adopting modern AI-powered data security and management solutions to respond rapidly to cyber threats.