Ransomware’s Payout Rate Fell by Half While the Average Payout Rose by a Third

I've spent enough years on both sides of a ransomware incident, running the response inside a company and later reading the vendor pitches that promise to stop the next one, to know when a statistic is being misread. This week it's happening in plain sight.

GuidePoint Security's GRIT report for the third quarter of 2026, published October 8, counted 2,760 ransomware victims, up 21 percent from the prior quarter and up 75 percent from a year earlier. Buried in the same report is the number everyone will quote instead: the share of victims who actually paid fell by more than half year over year. Coveware's incident response data puts the current paid rate at roughly 19 to 20 percent, a level that sat above 70 percent just a few years ago. Every headline I've seen out of this data says some version of "ransomware payments collapse" or "victims are finally saying no." That is the wrong headline.

The number that belongs on the front page is the one sitting two paragraphs down in GuidePoint's own release: among the victims who did pay, the average payment rose 34 percent year over year. Read those two numbers together and the story changes completely. This isn't a market in retreat. It's a market that got better at sorting its targets.

For most of ransomware's history as a business, the model was spray and negotiate. Hit as many organizations as possible, assume a majority will eventually pay something, and let the negotiation determine the final number. That model is dead, and it didn't die because defenders got better across the board. It died because attackers stopped needing a majority to pay. Mandiant's most recent intrusion data found confirmed data theft in 77 percent of ransomware cases in 2025, up from 57 percent the year before. Once stolen data itself has resale value and extortion leverage independent of whether the victim ever unlocks a single file, an attacker doesn't need the encryption payload to land or the ransom note to get a reply. Volume against the unlikely-to-pay majority became free money on the side, not the main event.

The main event moved upstream, to the smaller number of targets who have no real alternative to paying. Dark Reading reported that the same attackers increasingly ditch commodity tools like Cobalt Strike in favor of native Windows utilities already sitting on the box: ipconfig, netstat, ping, nltest. That's not a stealth upgrade for its own sake. Most ransomware and EDR detection logic I've seen built or bought over the last decade keys off known malicious tooling and encryption behavior. Living entirely off tools already trusted by the operating system routes around both. The organizations that still end up paying are disproportionately the ones where that detection gap, combined with a recovery plan that was never tested against the specific systems that actually went down, left no faster or cheaper option than the wire transfer.

This is where the CISO read and the investor read of this data split, and both sides are currently getting it wrong in a way that matters.

On the operator side, I've sat through more board updates than I can count where a falling ransomware payment rate gets presented as evidence the security program is working. For a lot of those organizations, it isn't evidence of anything. It just means they were never going to be a target an attacker expected to pay in the first place, small enough or boring enough to land in the mass-produced, data-theft-only bucket where the attacker's entire business case is volume, not negotiation. That's not a security win. That's demographic luck. The actual test of a ransomware program isn't whether your organization paid last year. It's whether you know, specifically, which systems you'd have no choice but to pay for if they went down tomorrow, and whether your backup and recovery plan has ever been rehearsed against exactly those systems rather than against the easy ones.

On the investor side, a meaningful share of the capital that's gone into ransomware resilience and recovery vendors over the last three years rests on a thesis that faster, cheaper recovery kills the ransom economy. The data above says that already happened, for the 80 percent of victims who now refuse or can't pay regardless of how good their backups are. That population solved itself. The remaining 20 percent, the ones paying 34 percent more than they did a year ago, are by definition the population where recovery already failed or was never fast enough to matter, often because the asset that went down was the one nobody had mapped as critical until it was gone. A generic backup pitch doesn't move that number. A product that tells a company in advance which of its systems fall into the no-good-recovery-option bucket, before an attacker finds that answer first, is solving a different and much harder problem, and almost nobody I've evaluated is actually selling that.

Ransomware did not get less profitable this year. It got more selective about who it goes after and more confident in what it can extract once it picks a target. The headline metric fell. The metric that actually describes the health of the business attackers are running, what the remaining payers hand over, rose by a third. The next GuidePoint and Coveware releases will tell us whether that concentration keeps compounding. If the paid rate drops under 15 percent next year while the average payment keeps climbing, that won't be a sign ransomware is dying. It will be a sign it finished figuring out exactly who its customers are.

Amit Spitzer is CTO and CISO at Glilot Capital, an early-stage VC investing in cybersecurity, AI, and enterprise infrastructure.