More Than Half of CISOs Would Pay a Ransomware Demand. The Maths Are Not Flattering.

Key points

• 58% of 750 CISOs surveyed by Absolute Software say their organisation would pay a ransom demand if attacked tomorrow.
• The FBI and the UK National Cyber Security Centre both advise against payment under any circumstances.
• IDC data shows 37% of hit companies paid; a third of those who refused recovered nothing at all.
• Around 5% of payers found decryption incomplete; only 60% of SMEs that paid recovered any data.
• Marks & Spencer declined to pay after its April 2025 attack and estimated the cost at $400 million in lost operating profit.

Would most CISOs really hand over the money?

Fifty-eight percent of CISOs surveyed by Absolute Software say yes. That figure, drawn from 750 respondents across the US and UK, sits in direct contradiction to the official positions of both the FBI and the UK National Cyber Security Centre, neither of which endorses payment.

The NCSC's position is unambiguous. "It is the UK government's long-standing position, alongside law enforcement partners, that it does not encourage, endorse nor condone the payment of ransom demands," a spokeswoman said. The FBI adds that paying funds further attacks on others.

But CISOs aren't running law enforcement agencies. They're running businesses.

"Attacks are increasing and continuing to increase," said Christy Wyatt, CEO of Absolute Software. "Companies are better prepared to deal with them: some of the training is paying off and AI is helping. But remember that attackers have all the tools that defenders have."

Should you worry about paying and still losing your data?

Yes. Stigma suppresses disclosure, so the actual payment rate is hard to pin down. IDC found 37% of ransomware victims paid, though research director for security services David Clemente puts the real figure higher. "I'm sure that there are many more who have paid it but don't want to be open about it," he said.

Paying guarantees nothing. IDC recorded that roughly 5% of payers ended up with incomplete decryption. A late-2025 survey by insurer Hiscox found only 60% of small and mid-size businesses that paid managed to retrieve all or part of their files. "You may get your data back, you may not," said Wyatt. And exclusivity isn't restored by payment: "We have heard instances of companies paying up and finding that their credentials are being shared."

Is refusing to pay any safer?

Not obviously. IDC found 29% of victims recovered encrypted files from backup without paying. But 33% of those who refused couldn't retrieve anything at all, a detail rarely prominent in law enforcement briefings.

The clearest recent reference point is Marks & Spencer, which declined to pay after ransomware hit its logistics systems and shut its online store in April 2025. M&S later put the bill at $400 million in lost operating profit. Whether paying would have cost less is unknowable.

With sixteen ransomware stories published in the last thirty days, the pattern we keep tracking is consistent: preparation gap determines outcome more than the payment decision itself. The companies that hold firm without losing data are the ones with tested, isolated backups. Everyone else is negotiating from weakness.