To pay, or not to pay: 58% of CISOs say they would pay the ransom for their data

A survey of 750 CISOs in the US and UK found that 58% would be willing to pay a ransom if hit by a ransomware attack, despite law enforcement in both countries advising against it. In practice, IDC data shows 37% of attacked companies actually paid — likely an undercount due to stigma. Outcomes for those who pay are mixed: about 5% received incomplete decryption, and only 60% of SMEs that paid successfully recovered their data. Companies that didn't pay fared no better in some cases — 33% couldn't recover anything. The M&S ransomware incident in April 2025, which cost an estimated $400 million in lost operating profit after the retailer refused to pay, illustrates the high stakes. The key takeaway is that robust, tested backups may be the deciding factor in whether paying is necessary.