A ransomware attack can put decisions in front of the board within hours. These include whether to shut down services, whether to engage with the attacker and whether to pay. Those decisions, and the security investment that determines which options are available, fall within the oversight duties that UK and EU regulation places on senior leadership. A board that has agreed its approach in advance can act faster during an incident and explain its choices afterwards.
What the evidence shows about ransomware payments
Data from incident response firms and blockchain analysts points to a falling payment rate. Coveware, which negotiates on behalf of ransomware victims, reported that the share of its cases ending in payment reached a record low in the second quarter of 2026. Chainalysis, which tracks cryptocurrency flows, estimated that 28.8% of victims paid in 2025, down from 78.9% in 2022.
The sums remain large for organisations that do pay. Coveware put the average payment in the second quarter of 2026 at about $1.88 million, with a median of $150,000. It linked the rise in the average to a few unusually large payments in cases involving stolen data, and it observed data theft in 76% of its cases that quarter.
Each firm's figures reflect its own client base, so they indicate a direction of travel and carry limited weight as precise measures of the whole market.
How the threat is changing
The National Cyber Security Centre assessed in January 2024 that AI would almost certainly increase the volume and heighten the impact of cyber attacks over the following two years, with the greatest uplift in reconnaissance and social engineering. Coveware reported in the second quarter of 2026 that phishing and social engineering had returned as the leading way attackers first gained access to victims' systems, including voice phishing and attackers posing as IT staff.
Where an attack begins with a convincing call to a help desk, technical controls on their own offer limited protection. Business processes, such as how staff verify the identity of someone asking for a password reset, become part of the organisation's defence and part of what the board needs assurance on.
Why the payment decision belongs with leadership
Paying a ransom carries legal, regulatory and ethical consequences that extend well beyond technical recovery. Guidance published in May 2024 by the NCSC with the Association of British Insurers, the British Insurance Brokers' Association and the International Underwriting Association sets out several of them. A payment may be unlawful if it reaches a sanctioned person or territory. A decryption key may restore systems slowly in a large organisation, and restoring from backups can be quicker. A criminal's promise to delete stolen data cannot be relied upon. The Information Commissioner's Office does not treat payment as a mitigation and would not reduce any penalty because of it.
The same guidance advises organisations to involve the right people across the business, seek objective external advice from insurers, the NCSC, law enforcement or incident response specialists, and keep a record of decisions on systems unaffected by the incident.
UK policy is also developing. In its response to consultation, published on 22 July 2025, the government set out proposals to prohibit ransomware payments by public sector bodies and by owners and operators of regulated critical national infrastructure, to require other organisations to engage with the authorities before paying, and to introduce mandatory reporting of ransomware incidents. Legal commentary in February 2026 reported that these proposals were still being refined with industry. Boards of organisations in or close to those sectors can track them as they progress.
What regulation expects of leadership
NIS2 requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures their organisation takes, oversee their implementation and follow training, and allows them to be held liable for infringements. DORA gives the management body of a financial entity ultimate responsibility for managing the entity's ICT risk. In the UK, the Cyber Security and Resilience Bill, now before the House of Lords, would extend the existing network and information systems regime and introduce initial incident notification within 24 hours.
Under each of these regimes, the board may need to show that it understood the organisation's risks and that the measures it approved were proportionate to them.
Prioritising investment against business impact
A defensible investment position starts with the services the organisation depends on and the length of disruption it can tolerate for each. From there, management can show which threats are most likely to cause that disruption, which controls reduce its likelihood or impact, and where the gaps lie.
A recognised framework, such as the NCSC Cyber Assessment Framework, the NIST Cybersecurity Framework 2.0 or ISO/IEC 27001, gives that assessment a consistent structure and lets the board track progress over time. Where spending is planned in this way, the board can explain why resources sit where they do, how priorities follow the most significant risks, and which risks it has chosen to accept.
For ransomware, the assessment can cover the capabilities that shape the options available on the day. These include backups that are isolated from the main network and tested by restoring from them, separation of critical systems so an attack cannot spread freely, identity checks at the help desk, and a decision framework for extortion demands that the board has agreed and exercised before an incident occurs.
Questions for the board
- Which services matter most to the organisation, and how long could we operate without each of them?
- When did we last restore a critical system from backup in a test, and how long did it take?
- Who has authority to decide whether to engage with an attacker or pay, and has the board agreed the principles in advance?
- How would we check sanctions exposure and involve insurers, law enforcement and regulators in the first hours of an incident?
- How does our security investment map to the risks to our most important services, and which risks have we accepted?
- How would our help desk verify the identity of a caller asking for a password reset or new access?
- Which current or proposed reporting and payment rules apply to us, in each country where we operate?
A Cyber Resilience Executive Exercise rehearses the decisions a ransomware attack would force with the executives who would own them, and ends in an improvement plan the management body can act on.
References
- Coveware by Veeam, "Cyber extortion payment trends Q2 2026", 29 July 2026.
- Chainalysis, "Crypto ransomware 2026", as reported by Computing, "Ransomware payments at record low", 27 February 2026.
- National Cyber Security Centre, "The near-term impact of AI on the cyber threat", January 2024.
- National Cyber Security Centre, Association of British Insurers, British Insurance Brokers' Association and International Underwriting Association, "Guidance for organisations considering payment in ransomware incidents", 14 May 2024.
- Home Office, "Ransomware legislative proposals: reducing payments to cyber criminals and increasing incident reporting", consultation response, 22 July 2025.
- Goodwin, "The UK's ransomware strategy", 12 February 2026.
- European Parliament and Council, Directive (EU) 2022/2555 (NIS2), 14 December 2022.
- European Parliament and Council, Regulation (EU) 2022/2554 (Digital Operational Resilience Act), 14 December 2022.
- UK Parliament, "Cyber Security and Resilience (Network and Information Systems) Bill", Bill page and stages.
- National Institute of Standards and Technology, "The NIST Cybersecurity Framework (CSF) 2.0", February 2024.