Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Enterprise Security Teams Are Using Ransomware Negotiation Firms
Transcript
- Lucas: If your company gets hit with ransomware, and the files are encrypted, and the attackers are demanding five million dollars in Bitcoin — who actually makes the call to pay or not? And if the answer is yes, who picks up the phone and negotiates with the criminals? Luna: I think most people assume the CISO or the CEO decides. But more and more, companies are outsourcing that conversation to specialists. Lucas: Exactly. There's a whole sub-industry of professional ransomware negotiators. Firms like Coveware, Kivu Consulting, Arete — they act as intermediaries between the victim and the threat actor. And their job is to reduce the ransom, ideally while getting the decryption key. Luna: So they're basically hostage negotiators, but for data instead of people. Lucas: That's the analogy the industry uses. And the numbers show it works. According to data from Coveware's quarterly reports, the average ransom payment in Q1 of this year — 2026 — was about eight hundred and twelve thousand dollars. That's down eighteen percent year-over-year. But the initial demands are often much higher. Luna: How much higher? What's the typical starting ask? Lucas: Coveware's data suggests the median initial demand is around two million dollars. Negotiators usually get it down to less than half that. In some cases, they pay nothing — they've found a backup or a decryption tool. But when payment happens, it's almost always through a negotiator. Luna: And what's the playbook? How do they actually talk these people down? Lucas: It's surprisingly data-driven. The negotiators maintain extensive databases of past ransomware incidents — which group, what they demanded, what they accepted, how fast they responded. So when a Conti affiliate demands five million, the negotiator can say, 'Your group's average settlement for a company this size is eight hundred thousand. We'll pay seven hundred thousand now, or you get nothing and we restore from backup.' Luna: And the attackers just go along with that? Lucas: Often, yes. Because these groups are rational in a twisted way. They want to get paid quickly and move on. If they hold out for a higher number, they risk the company restoring from backups, or law enforcement getting involved, or the negotiation dragging on and their infrastructure getting taken down. So a guaranteed seven-figure payout today is better than a maybe bigger payout next week. Luna: But there's an obvious ethical problem here. If you pay a ransom, you're funding criminal enterprises. You're encouraging more attacks. The FBI says don't pay. Lucas: The official FBI position is absolutely do not pay. But the unofficial reality is more nuanced. Law enforcement knows that in many cases, companies have no viable backups, or the data is so sensitive that even a small leak could destroy them. So the FBI sometimes works quietly with negotiators to gather intelligence while the payment happens. It's a harm-reduction approach. Luna: Harm reduction — that's an interesting frame. Like, 'we don't want you to pay, but if you're going to anyway, here's how to do it safely and maybe help us catch them.' Lucas: Right. And that's why some cyber insurance policies now actually mandate the use of a negotiation firm. If you have a policy that covers ransomware, the insurer says, 'You have to call this number first. Do not talk to the attackers yourself.' Because insurers have learned that unmediated victims pay way more and often make things worse. Luna: Worse how? What mistakes do companies make when they negotiate on their own? Lucas: Classic mistakes: responding too emotionally, revealing how desperate they are, offering too much too fast. I've heard of executives who literally wrote, 'Please, we're a small business, we'll go bankrupt, here's our entire savings' — which just tells the attacker they can squeeze harder. Negotiators are trained to be clinical, to use specific language that signals experience, to drag out the timeline so the attacker's costs go up. Luna: So part of the value is just having someone who seems like they've done this before. Lucas: Exactly. The attackers profile you. If they think they're dealing with a first-timer, they push. If they think they're dealing with a professional negotiator who knows the ransomware landscape, they're more likely to settle quickly. It's a form of signaling. Luna: What about the companies that decide not to pay at all? How common is that? Lucas: More common than you'd think. Coveware's data shows that in Q1 2026, only about thirty percent of ransomware victims actually paid. The rest restored from backups or used decryption tools. But that still means almost a third of companies are paying. In dollar terms, ransomware payments exceeded one point two billion dollars globally last year. Luna: And the negotiation firms take a cut of that, right? So they have a financial incentive to facilitate payment. Lucas: They do. Most charge a retainer plus a percentage of the ransom saved or paid. Typically around five to ten percent. So if they reduce a demand from two million to eight hundred thousand, they might earn forty to eighty thousand dollars. It's a lucrative business. Luna: That's a lot of money. And it raises the question: are these firms actually helping the ecosystem, or just greasing the wheels of extortion? Lucas: That's the central debate. The firms argue they're providing a necessary service in a broken system. They say, 'Look, we don't want ransomware to exist either. But when a hospital can't access patient records and lives are at stake, you need someone who can get the data back fast.' And they point out that their data helps law enforcement track payment flows and identify groups. Luna: What about the recent changes in ransomware group behavior? I read that some groups are now using 'double extortion' — encrypting data and threatening to leak it. Does that change the negotiation? Lucas: Dramatically. With double extortion, the negotiator has to manage two threats: getting the decryption key and preventing a data leak. That means they have to assess the value of the data to the attacker and to the victim. Sometimes the attacker demands a separate payment for not leaking. Negotiators have to evaluate whether the attacker even has the data — because sometimes they bluff. Luna: How do they verify that? Lucas: They ask for proof — a sample of the stolen data that only the victim would recognize. If the attacker can provide that, the threat is real. If they can't, the negotiator might call the bluff and refuse to pay the data leak portion. It's a high-stakes bluffing game. Luna: And the legal risks? If you're a publicly traded company and you pay a ransom to a sanctioned entity — say a Russian group under OFAC sanctions — you could face fines. Lucas: That's a huge concern. The Office of Foreign Assets Control has issued guidance saying that paying a ransom to a sanctioned group could be a violation. But they also said they'd take a 'mitigating factor' approach — if you cooperate with law enforcement, have good cybersecurity practices, and use a negotiation firm, they're less likely to penalize you. So again, using a professional negotiator becomes a way to show good faith. Luna: If today was actually useful to you, the way these stay ad-free is listener support — buy me a coffee dot com slash fexingo. Lucas: Yeah, that's the model. No sponsors, no ads, just listeners who find value in the show and chip in to keep it going. We appreciate that. Luna: Alright, back to the negotiation table. What's the most surprising thing you've learned about how these firms operate? Lucas: Probably that they sometimes advise clients not to pay. If the decryption key is unreliable — which happens — or if the attacker is known to be a group that doesn't actually decrypt after payment, the negotiator will say, 'Don't pay. You'll lose your money and still not get your data.' That's actually a sign of integrity in a shady business. Luna: So the best negotiators aren't just transaction brokers. They're providing intelligence and risk assessment. Lucas: Exactly. And that's why the role is expanding. Some firms now offer what's called 'ransomware readiness assessment' before an attack — they simulate a negotiation to test the company's incident response plan. And more CISOs are building relationships with these firms ahead of time, so if the worst happens, they're not cold-calling a random number. Luna: It's like having a fire department on retainer. You hope you never need it, but if you do, you want someone who knows the building. Lucas: That's exactly the analogy. And the fire department is getting smarter every year. As ransomware groups evolve — using ai generated phishing, targeting cloud infrastructure, demanding payment in privacy coins — the negotiators evolve too. They're now tracking blockchain wallets in real time to see if a group is cashing out, which changes their willingness to settle. Luna: So the cat and mouse game continues. And the negotiators are the mice who talk to the cat. Lucas: Well put. And as long as ransomware exists, there will be someone on the other end of the chat window, trying to get the price down.