Despite growing awareness and improved defences, nearly half of global organisations still opted to pay ransoms to cybercriminals in 2025, according to a new report by cybersecurity firm Sophos.

The “State of Ransomware 2025” report, released on Tuesday, revealed that 46 per cent of companies surveyed paid a ransom to regain access to their data — the second-highest rate in six years.

While the proportion of ransom payers remains significant, Sophos noted that 53 per cent of victims who paid successfully negotiated a reduced amount from the initial demand, often with the support of external experts or through direct negotiation.

Median Payments Fall Sharply

One of the most notable trends was a steep drop in the median ransom payment, which fell by 50 per cent year-on-year, from $2 million in 2024 to $1 million in 2025. The average ransom demand also declined by a third, signalling a growing ability among organisations to manage the financial fallout of such attacks.

“Thanks to increased awareness, many companies are now hiring incident responders who can reduce ransom payments and speed up recovery,” said Chester Wisniewski, Field Chief Information Security Officer at Sophos.

Entry Points and Skill Gaps

The report identified exploited vulnerabilities as the most common attack vector for the third consecutive year, with 40 per cent of victims reporting that cybercriminals gained access through unknown security gaps.

A shortage of skilled personnel was cited as a critical weakness by 63 per cent of organisations. Larger companies blamed a lack of cybersecurity expertise, while mid-sized firms pointed to understaffing.

Organisational Resilience Growing

Despite the persistent threat landscape, the report highlights improving resilience among victim organisations:

• 44 per cent of attacks were intercepted before data encryption, the highest rate in six years.
• The proportion of attacks resulting in data encryption dropped to 50 per cent, also a record low.
• Over half of affected firms recovered within one week, a significant improvement from 35 per cent in 2024.
• Only 18 per cent required more than a month to recover, compared to 34 per cent the previous year.

The average cost of recovery fell sharply from $2.73 million in 2024 to $1.53 million in 2025.

Sector-Specific Trends

Ransom demands varied widely across industries. State and local governments reported the highest median ransom payments at $2.5 million, while healthcare organisations recorded the lowest, at $150,000.

The report also found a decline in the number of organisations relying on backups for data restoration — now at 54 per cent, the lowest figure recorded since Sophos began tracking the data six years ago.

Strategic Recommendations

Sophos advised firms to adopt proactive cybersecurity strategies, including:

• Timely patching of software vulnerabilities
• Multi-factor authentication (MFA)
• Investment in managed detection and response (MDR) services
• Enhanced visibility into IT infrastructure

“Ransomware can still be ‘cured’ by addressing the core issues: patching vulnerabilities, increasing visibility into the attack surface, and boosting resources,” Wisniewski added.

The State of Ransomware 2025 report is based on responses from 3,400 IT and cybersecurity leaders across 17 countries, all of whom experienced at least one ransomware incident between January and March 2025.

While ransomware remains a costly and evolving threat, the findings suggest that organisations are becoming more capable of responding quickly, reducing payments, and limiting overall impact.