Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Companies Use Ransomware Negotiation Firms to Manage Breach Fallout
Transcript
- Lucas: When a company gets hit with ransomware, the first instinct is to say no, never pay. But the reality is more complicated. A growing number of enterprises now hire third-party negotiation firms to handle the ransom demand directly. Luna: So instead of calling law enforcement, they call a negotiator? Lucas: Exactly. These firms — often staffed by former FBI cyber agents or crisis psychologists — step in as the intermediary between the victim and the ransomware group. They assess whether the attackers are bluffing, how much they might lower the demand, and whether paying actually gets the decryption key. Luna: And how common is this? Lucas: According to a 2025 report from Coveware, roughly 42 percent of ransomware incidents now involve a professional negotiator. That's up from maybe 15 percent just three years ago. It's become a standard line item in the incident response budget. Luna: It sounds like a weird negotiation — you're dealing with criminals who might just take the money and run. Lucas: That's the risk. But these firms have track records. They know typical ransom tiers: for mid-sized companies, the initial demand might be five or six figures. They'll often counter with a lower figure and cite the company's revenue or insurance limits. They also coordinate with legal and insurance teams in real time. Luna: Does paying actually work? Statistically? Lucas: Coveware's data shows that when a negotiator is involved, the final payment is on average 38 percent lower than the initial demand. And the recovery rate — getting data back — is about 92 percent. But of course, paying funds the entire criminal ecosystem. Luna: Right, and that's the ethical tension. So why not just restore from backups? Lucas: In a perfect world, that's the answer. But attackers have gotten better at exfiltrating data before encryption, so even if you restore your systems, they threaten to leak sensitive information. That's where the pressure comes from. 94 percent of ransomware attacks now involve data theft, not just encryption, according to Unit 42's 2025 report. Luna: So it's extortion on top of ransomware. That changes the calculus completely. Lucas: It does. And that's why the negotiator's job is partly reputation management — they help the company assess whether the data is truly sensitive enough to justify paying. Luna: I imagine the negotiators themselves come from pretty unique backgrounds. Lucas: Absolutely. Many are former law enforcement, especially from the FBI's cyber division. Others come from crisis communications. A few firms even employ behavioral psychologists to read the attackers' negotiation style. Kivu, one of the biggest names in this space, built its entire practice around veteran negotiators. Luna: Look, this is a niche but fast-growing corner of cybersecurity. And honestly, it's the kind of thing we get to dig into because of the listeners who support the show. A handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making this many episodes without ads. So if these deep dives are useful for what you're building or running, that's the way to keep them going. Lucas: Yeah, it's a huge help. And it keeps the show independent. Lucas: So back to the negotiators — Kivu told me that their negotiators often start by verifying the attacker's identity. They look at the ransom note, the encryption pattern, the leak site — to see if it matches known groups like LockBit or BlackCat. Luna: So they're profiling the criminal group before even talking? Lucas: Precisely. They'll run the file extension and ransom note through their own threat intel databases. If it's a known group, they know their typical behavior — some are more likely to negotiate, others are known to just take the money and leak regardless. Luna: Is there a group that's notoriously difficult to negotiate with? Lucas: Conti, before it disbanded, was known for aggressive negotiation tactics. More recently, the BlackCat group has shown a willingness to negotiate, but they also exfiltrate data aggressively. LockBit tends to be more business-like — they'll negotiate down if you show you can't afford the full amount, but they're ruthless about data leaks if you don't pay. Luna: So the negotiator has to know the psychology of each group. Lucas: Exactly. And that's why the best firms maintain private databases of attacker negotiations. They track what worked and what didn't. It's almost like adversary diplomacy. Luna: Does the negotiator always pay in cryptocurrency? Lucas: Almost always. Bitcoin is still the standard, though some groups now demand Monero for its privacy. The negotiator works with the company's treasury or insurance to ensure the funds are available in the right crypto, and then transfers it under strict chain of custody procedures. Luna: Is there any legal risk to using these firms? Could the government go after the company for funding terrorists? Lucas: That's a real concern. OFAC — the Office of Foreign Assets Control — has issued guidance warning that facilitating payments to sanctioned entities could lead to fines. Many negotiation firms now do sanctions screening on the ransom wallet address before sending any money. If the attacker's wallet is tied to a sanctioned group, the negotiator will advise the company not to pay. Luna: So they're also acting as a compliance checkpoint. Lucas: In a way, yes. They're a fallible human shield between the company and the legal consequences of making a ransom payment. Luna: Given all this, are we seeing any pushback? Any companies that flatly refuse to negotiate? Lucas: Some large enterprises have public 'no pay' policies. But the data shows those policies often break in the face of a real incident. The board pressure to restore operations and avoid data leaks is immense. A 2024 survey from Proofpoint found that over 70 percent of companies that said they would never pay ended up paying after a ransom event. Luna: That's pretty honest. So in practice, negotiation firms are here to stay. Lucas: I think so. But the industry is evolving. Some insurers now require you to use a specific negotiation firm as a condition of coverage. And there are new startups offering automated negotiation bots that handle the initial back and forth. That raises even more questions about trust and competence. Luna: A bot negotiating with a criminal — that sounds like a sci-fi movie. Lucas: It does. And maybe that's where we're heading. But for now, the human negotiator — with their gut feel, their rapport-building, their awareness of precedent — still makes the difference between a bad outcome and a manageable one. Luna: So the question becomes: how do you prepare your team to decide whether to call in a negotiator, and fast enough? Lucas: Exactly. That decision often has to be made within the first hour. And it's a conversation that CISOs and boards need to have before an incident, not during.