The Ransomware Paradox: Why Payments Are Soaring as Attacks “Drop”

COMMENTARY: Ransomware is now more strategic. Attackers are taking their time, picking better targets, and hitting when the damage will hurt most. When systems go down, companies are thinking about lost revenue, broken services, and angry customers, and that is why payouts keep rising. For MSSPs and MSPs, this changes the job. It is less about selling another security tool and more about helping customers see problems early, respond faster, and stay operational when something does break.

After years of massive cybersecurity investments and “best-practice” awareness campaigns, logic suggests we should see a decline in the financial impact of ransomware. Instead, we’re seeing the opposite.

New research highlights a strange contradiction: organizations saw fewer incidents this past year, dropping from an average of eight in 2024 to about five or six in 2025. Yet the average ransom payout has surged to $3.6 million, an increase of more than $1 million year over year.

This contradiction reveals the industry’s current reality, where attack volume is falling while financial impact is soaring. For the IT channel, this paradox is reshaping customer expectations and increasing operational risk. Understanding the forces behind it is essential to protecting their own environments, as well as their customers’.

The Business Case for the Payout

Why are companies paying more? Because the cost of doing nothing is higher. Even a brief operational “hiccup” can be fatal to service delivery and customer support. When the math of downtime outweighs the ransom, leadership often views payment as the most pragmatic, if painful, short-term move.

Cyber insurance adds another layer to this. While these policies provide a financial safety net, they also inadvertently subsidize the cybercriminal economy, keeping the cycle in motion. Perhaps most concerning is the increase in dwell time, which now averages two weeks. This gives attackers a massive window to map systems and networks and identify high-value targets, ensuring that when they finally strike, they cause maximum operational pain.

Complexity: The Attacker’s Playground

Our environments are becoming harder to defend by the day. The explosion of multi-cloud setups, remote endpoints, and IoT devices has created a massive attack surface. Despite having dozens of security tools, many teams are still “flying blind” due to a lack of unified visibility and overwhelming alert fatigue.

For the IT channel, this gap is both a major challenge and a significant opportunity. Customers are no longer just looking for “tools”; they are looking for partners who can provide true visibility and risk reduction.

The Channel Is the New Front Line

The ransomware economy is evolving, with threat groups now using generative AI to scale reconnaissance and craft more convincing attacks faster than most teams can respond.

The reality is that the IT channel - MSPs, MSSPs, and third-party vendors - now sits directly in the crosshairs. Because these providers have broad reach and deep access, they represent “high-yield” targets. A single compromise can open the door to hundreds of secondary targets. Groups like Scattered Spider and DragonForce have already proven this by executing campaigns that specifically exploit MSP vulnerabilities. This is a wake-up call for the channel: you are no longer adjacent to the attack; you are part of the attack chain.

Moving from Reactive to Resilient

Paying a ransom might feel like the fastest way back to “normal,” but it only fuels the ransomware-as-a-service (RaaS) engine. Breaking this paradox requires moving beyond reactive tools toward true proactive resilience.

This shift requires:
Continuous Monitoring: You can’t protect what you can’t see. Monitoring the entire attack surface is non-negotiable.
Deep Visibility: Expanding visibility across networks, IoT, and customer environments to eliminate “blind spots.”
Forward-Looking Playbooks: Developing strategies that account for AI-driven threats.

In today’s market, resilience is a competitive differentiator. The MSPs and MSSPs that can help customers navigate this paradox with better visibility and faster detection will be the ones that build the deepest trust. The cycle won’t break itself; the channel must lead the way.

MSSP Alert Perspectives columns are written by trusted members of the managed security services, value-added reseller and solution provider channels or MSSP Alert's staff. Do you have a unique perspective you want to share? Check out our guidelines here and send a pitch to [email protected].