Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cyber Insurance Is Rethinking the Ransomware Decision
Transcript
- Lucas: So there's a moment every CISO hopes never comes: the screens go red, the ransom note lands, and someone from the board is already texting, asking what this is going to cost. But here's the thing — the real decision isn't 'can we decrypt?' It's 'should we pay?' And that's a financial call, not just a security one. Luna: And it's a call that's getting more complicated, not less. We've seen the headlines — but today I want to unpack the actual calculus: insurance terms, stock price, downtime costs, all of it. Lucas: Exactly. And before we dive into that, let me just say — if this kind of breakdown is useful for what you're building or running, the reason we can keep doing it ad-free is listener support. So if you get something out of today, buying us a coffee at buy me a coffee dot com slash fexingo is a great way to keep that going. Luna: Yeah, it genuinely helps us keep the lights on and the microphones on. Now, let's get into the ransom question. Lucas: So let's anchor on a case that flipped the script: the 2023 Change Healthcare attack. That was the one where the company reportedly paid a ransom — and then, weeks later, the attackers came back for more. The payment didn't buy peace; it bought a sequel. Luna: Right, and that's the nightmare scenario. But the data actually shows that paying is still more common than not. Why is that? Lucas: Because for a lot of firms, the math points to 'pay' — at least in the short term. The average ransom demand in 2025 was around $2.5 million, but the average cost of downtime for a mid-sized enterprise runs way higher. And that's before you factor in the stock drop, the customer churn, the legal fees. When your systems are down, every hour burns cash. So paying can look like the cheapest option. Luna: But that's the short-term math. What about the long term? I mean, Change Healthcare paid and still ended up in court. Lucas: Right, and that's where insurance enters the picture. Most cyber policies used to cover ransom payments outright. But after a wave of claims, underwriters started adding clauses that require the insured to prove they've exhausted other options — like backups or decryption tools — before they'll greenlight a payment. And some policies now explicitly exclude coverage if the company pays against law enforcement advice. Luna: So the insurance company is now a party to the decision. That changes the CISO's job — they're not just negotiating with the attackers, they're negotiating with their own carrier. Lucas: Exactly. And that's led to a weird new strategy that some firms are using: pay and chase. You pay the ransom, get your systems back, and then you sue your insurer for refusing to cover the payment in the first place. It's messy, but it's happening. Luna: It's a nice little legal Hail Mary. But doesn't it also signal to the market that you're a target? I mean, if you're a public company, the moment you disclose a breach, your stock takes a hit. Lucas: It does, and that's the other half of the calculus. There's research showing that after a breach, public firms lose about two percent of their market cap on average. But here's the twist — if you pay the ransom and you're back online quickly, that loss is smaller. So the market, in a way, rewards paying up. It's a short-term hedge against longer-term reputational damage. Luna: That's a perverse incentive. It's like the market is saying 'just pay the criminals, get back to work, we'll forgive you.' Lucas: Which is exactly why regulators are stepping in. The SEC's new disclosure rules, which are fully in effect now as of 2026, require companies to report material breaches within four business days. And they're also asking companies to say whether they paid a ransom. That's a game-changer, because it forces the board to think about the long-term signal they're sending. Luna: So now the decision isn't just 'do we get our data back?' It's 'what does this say to our shareholders, our customers, our regulators?' Lucas: Right. And that's why some companies are building ransom capacity into their risk budgets. I'm talking about setting aside a specific fund, separate from insurance, that's earmarked for potential ransom payments. It's controversial, but it's a real trend. Luna: It's like a kidnapping insurance policy for your data. But isn't that just inviting more attacks? If the criminals know you have a ransom fund, doesn't that make you a bigger target? Lucas: That's the argument. And it's one reason some firms keep that fund quiet. But the other side is that the fund comes with a decision framework — like, we only use it if the cost of downtime exceeds a certain threshold, or if the data involves critical infrastructure or personal info. It's not a blank check. Luna: So it's a calculated risk. I'm thinking of that hospital in the Midwest that paid a ransom because patient data was locked up — they couldn't wait for a decryptor. That's a different scenario than, say, a software company with backups. Lucas: Exactly. The nature of your data matters. For a hospital, a day of downtime can literally be life or death. For a tech company, it might be annoying but recoverable. So the calculus shifts based on what you're protecting. Luna: And that's where the insurance industry is going too, right? I've seen policies that now have different sub-limits for different types of data — like a higher sub-limit for payment card data or health records. Lucas: Yeah, that's a big shift. Policies are getting more granular. But the flip side is that premiums are climbing — up like thirty percent year over year in some sectors. So there's pressure to balance coverage with cost. Luna: So what's the CISO of a mid-sized firm supposed to do? They can't afford all the coverage, and they can't afford to be wrong. Lucas: That's the million-dollar question. And honestly, the answer is to treat it like any other risk decision. You run the numbers on your own downtime cost, your own regulatory exposure, your own customer sensitivity. You don't just rely on the insurance policy as a safety net. Luna: But isn't that exactly what insurance is for? To be a safety net? Lucas: It should be. But the insurance market has been tightening since the big ransomware waves of the early 2020s. Carriers are more selective, they're demanding better security hygiene before they'll even quote. And they're starting to put caps on ransom coverage — like a fifty million dollar sub-limit. So you can't just buy your way out of the problem. Luna: That's a sobering thought. So what's the trend for 2026? Are we seeing more companies resist paying, or is it still the default? Lucas: The early data from this year suggests a slight shift toward not paying — partly because of the regulatory scrutiny, partly because backups and incident response have gotten better. But the reality is that a lot of firms still end up paying, especially if the attackers have exfiltrated sensitive data and are threatening to leak it. Luna: Right, the double extortion. That changes everything. They don't just lock you out, they hold your customer data hostage. Lucas: And that's where the insurance clause about 'exhaust other options' gets murky. Because if the data is already out, you can't un-leak it. So paying to prevent the release might be the only option — and some policies now cover that under a separate 'extortion' limit. Luna: So the decision tree is getting more complex, but the basics are still the same: what's it going to cost us, and what are we willing to risk? Lucas: Exactly. And that's why I think the most important trend is that ransom decisions are becoming a board-level conversation. The CISO is no longer making this call alone. It's the CISO, the CFO, the general counsel, and the CEO — all looking at the same spreadsheet. Luna: And that spreadsheet better have some real numbers in it. Not just the ransom amount, but the cost of downtime, the legal fees, the potential fines, the stock hit. Lucas: For sure. And one of the more interesting tools I've seen is a ransom decision matrix — a formalized flowchart that walks through the data types involved, the legal obligations, the insurance coverage, and the operational impact. It's like a tabletop exercise, but you run it when the threat is real. Luna: That sounds like something every enterprise should have. But how many actually do? Lucas: Not enough. A survey from earlier this year found that only about a third of companies have a formal, pre-approved ransom response plan. The rest are winging it when the attack happens — which is the worst time to be making these decisions. Luna: It's like having a fire drill, but for cyber. You don't want to be figuring out the exits when the building is already burning. Lucas: Exactly. And that's really the takeaway here — the ransom decision isn't a security decision, it's a business decision. And the companies that treat it that way, with the numbers and the frameworks in place, are the ones that come out ahead. Luna: So for our listeners who are in the trenches, what's the one thing they should do this week? Lucas: Run the numbers before you need them. Estimate your cost of downtime, know your data types, and talk to your broker about what your policy actually covers. Do it now, because when the ransom note arrives, you won't have time to figure it out. Luna: That's the kind of advice that could save a company. And on that note, we're out. Thanks for listening — we'll catch you next time.