Why do ransomware payments keep rising even when defenders improve detection and response?

Why rising ransomware payments persist despite better detection

Ransomware payments keep rising because detection and response improvements do not remove the attacker’s monetisation window. If a crew can still encrypt, exfiltrate, or threaten release before containment completes, the economic pressure remains. The market has also become more specialised, with access brokers, infrastructure operators, and laundering paths reducing the friction needed to turn intrusion into cash.

Defenders may improve mean time to detect and respond, yet attackers only need a small number of successful extortion events to sustain the model. That mismatch, combined with faster adaptation in tooling, keeps payments viable even when security teams become better at finding and containing incidents.

What changes in the ransomware economy as defenders improve

Better detection changes the attack path, not the core business model. Ransomware groups adapt by shortening dwell time, targeting backup and recovery systems sooner, and using initial access brokers or pre-positioned credentials so they can move directly to impact. As a result, the defender’s gains often reduce blast radius, but they do not always prevent extortion leverage from being established first.

The ecosystem also fragments work across specialists. One group gets access, another stages the payload, another negotiates, and another launders proceeds. That division of labour lowers the operational burden and makes enforcement harder because no single compromise step has to succeed for the whole campaign to remain profitable.

When response is faster, attackers tend to shift toward speed, automation, and repeatable intrusion paths.

When one payment avenue becomes harder, crews often pivot to double extortion, data theft, or pressure on recovery timing.

When defenders close one weakness, the market often moves to the next easiest source of leverage rather than disappearing.

Why containment improvements do not fully break extortion pressure

Ransomware economics depend on the defender’s tolerance for business interruption, data exposure, and recovery uncertainty. Even if teams detect earlier, they still have to decide whether they can restore quickly enough, whether stolen data can be trusted as unreleased, and whether the attack has touched systems that matter for operations. Those decisions are often made under time pressure, which is exactly where extortion works best.

The payment decision is also shaped by operational asymmetry. Attackers can probe many targets at relatively low cost, while defenders must harden systems, monitor alerts, validate scope, coordinate recovery, and preserve evidence at the same time. That imbalance means incremental defensive improvement may reduce the number of successful incidents, but it does not automatically remove the incentive to pay when a single incident threatens continuity or reputation.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	RS.RP — Response Planning	Ransomware payments reflect how quickly response can limit extortion leverage.
	RC.RP — Recovery Planning	Payments rise when restoration cannot outpace business-impact pressure.
Recommendation — Test recovery and response playbooks against realistic ransomware timelines. Build and rehearse restoration paths that restore critical services without negotiation.
CIS Controls v8	11 — Data Recovery	Extortion pressure drops when reliable recovery reduces attacker leverage.
	17 — Incident Response Management	Faster detection helps only when incident handling can contain extortion quickly.
Recommendation — Maintain and verify backups that can be restored under ransomware conditions. Practice ransomware incident handling so containment decisions happen fast.
MITRE ATT&CK	T1486 — Data Encrypted for Impact	The question centers on ransomware impact and the attacker’s monetisation path.
	T1657 — Financial Theft	Ransomware payments are ultimately a monetisation problem.
Recommendation — Map encryption-for-impact activity to detection and containment coverage. Track the payment and laundering chain alongside intrusion and impact signals.

Practitioner Guidance

What to prioritise: Judge ransomware resilience by how quickly you can restore critical services without negotiating, not just by detection speed. If the attacker can still reach backup systems, identity planes, or recovery tooling before containment, the organisation remains economically exposed even with better alerts.

What to verify: Validate that recovery paths are isolated, tested, and genuinely faster than an extortion timeline. In practice, the key question is whether a clean restore can outpace the attacker’s ability to demonstrate impact or threaten leakage.

Practitioner takeaway: Detection matters, but payment pressure falls only when defenders shrink the attacker’s monetisation window and reduce the leverage created by data exposure, service outage, and recovery uncertainty.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.