Over half (58%) of cybersecurity leaders would consider paying cyber-criminals to end a ransomware attack, with 46%ranking operational downtime as the most significant impact ransomware is likely to have on their organisations.

These are among findings revealed in The Ransomware Reality: Zero Days to Recover. This new report from Absolute Security includes results from a survey of  750 enterprise chief information security officers (CISOs) across the United States and United Kingdom, conducted by independent polling provider Censuswide

“It is not surprising to learn that despite regulatory pressure, security and risk leaders remain open to paying a ransom to recover their systems and protect data when considering that prolonged downtime can lead to unsustainable losses,” said Christy Wyatt, President and CEO, Absolute Security.

“CISOs who build systems that can quickly restore continuity after disruptive attacks can avoid getting trapped in a cycle which will only grow alongside cybercriminals’ increasing use of AI-powered attacks.”

Ransomware continues to top CISOs’ ledgers as one of the most menacing threats they face, with their endpoint device infrastructures significantly vulnerable. Over the past 12-18 months, 57% reported their enterprises experienced an attack that originated on a remote, mobile, or hybrid device, with 58% in agreement that an incident left endpoints inoperable.

Neither finding was unpredictable, when considering that additional telemetry-based research from millions of PCs revealed critical endpoint security controls fail to operate 20% of the time.

This second edition in the State of Enterprise Cyber Resilience research series surfaced additional salient findings that further expose how ransomware is impacting operational resilience.

Included in the report were additional results with very eye-catching stats. Namely, 83% of CISOs reported being confident in their businesses’ ability to recover from ransomware, yet 57% took as long as six days to bounce back and 20% took as long as two weeks. No CISOs reported having the ability to recover within a day.

Recommended reading

• Negligence Stirring Rise in Cyber Incidents
• Inside the Aftermath: What Really Happens When You Get Hacked
• Report: 93% of Data Breaches Expose Financial Records

Despite knowing that ransomware continues to cause operational disruptions, 59% of organisations agree they must take physical possession of an endpoint to remediate and restore the device after an incident.

Only 53% of organisations have remote recovery capabilities in place, despite the wide-spread availability of such tools.

CISOs reported that legacy system patching is the second most challenging ransomware mitigation method at 42% (this was only 1% behind the top-ranked challenge—Employee Awareness Training at 43%).

With Claude Mythos showing that advanced LLMs in the hands of defenders and attackers can surface vulnerabilities at speeds the industry cannot keep pace with, organisations will face continued disruption caused by threats that leverage unmitigated software risks. This means that while patching must remain a key security tactic, the ability to recover from increasing vulnerabilities and exploits must rise to the top of the priority stack.