Ransomware negotiation basics: what defenders should know before an attack
Ransomware negotiation is not something to improvise during an attack. The decision to engage with extortionists, and whether to pay, is a business, legal and technical call that works best when the groundwork is laid before an incident. This guide covers the preparation, not how to pay.
Why negotiation planning matters
When ransomware hits, the organisation is under pressure: systems are down, staff are anxious and executives want answers. Decisions made in that state tend to be rushed and poorly informed. Attackers know this, and they rely on urgency to push victims toward quick choices.
Planning moves the hard questions to a calm moment. Who has authority to decide? Who must be told? What are the legal limits? What would recovery realistically look like without paying? Answering these in advance gives responders room to think instead of react.
This is a defender’s view of preparation. It is not guidance on conducting or facilitating payments, and nothing here should be read as encouraging them.
A decision for the whole business, not just IT
Negotiation sits at the crossroads of several functions. Technical teams understand what is encrypted and what can be restored. Legal teams understand regulatory duties and exposure. Finance, communications and senior leadership weigh the operational and reputational cost. If any of these voices is missing, the decision is weaker.
Write down roles in your incident response plan: who leads, who approves, who speaks to outsiders and who documents each step. Keep contact details for these people available offline, because the corporate email and chat systems may be unavailable during an incident.
Bring in legal counsel, insurers and law enforcement early
Three outside parties deserve early involvement:
- Legal counsel can advise on notification obligations, privilege over investigation findings and the risks of any contact with the attacker.
- Cyber insurers, if you hold a policy, often have required notification steps and panels of approved responders. Late notice can complicate coverage, so check your policy terms now.
- Law enforcement can receive reports and may have useful context. CISA runs a StopRansomware resource hub, and the FBI-run Internet Crime Complaint Center (IC3) accepts reports of internet-enabled crime.
Check sanctions exposure
Some ransomware operators or their associated entities may be subject to sanctions in certain jurisdictions. Making a payment to a sanctioned party can create legal risk for the victim on top of the incident itself. This is a question for qualified counsel and not something to assess from a news article. The point for planning is simple: raise sanctions exposure as a standing item in your response process, so it is checked before any decision rather than after.
Why payment is never a guarantee
Paying does not guarantee a good outcome. A decryption tool provided by attackers may not work fully, may be slow, or may leave some data damaged. Stolen data is a separate problem: a promise to delete it cannot be verified, and there is no reliable way to confirm that copies do not remain.
Payment can also mark an organisation as willing to pay, and it does not remove the underlying access that let the attackers in. If the entry point is not found and closed, the same environment can be targeted again. Treat any decision to pay as one input among many, not as a way to make the problem disappear.
Reduce the attacker’s leverage before an incident
The most effective negotiating position is one in which the attacker has little to offer. Extortion works because victims need something back: access to systems, or silence about stolen data. Reduce both.
- Backups: keep copies that attackers cannot reach with the same credentials used to administer production, including offline or immutable copies.
- Tested recovery: a backup that has never been restored is an assumption. Rehearse restoring critical systems and measure how long it takes.
- Segmentation: limit how far an intruder can move so that one compromised host does not mean a compromised network.
- Data minimisation: data you no longer hold cannot be leaked, so retire what you do not need.
Reduce the likelihood of getting there
Preparation for negotiation should sit alongside prevention. Many intrusions start with a known, patchable weakness, so a disciplined approach to vulnerabilities lowers risk. Our explainers on patch prioritization with CVSS, EPSS and KEV, the CISA KEV catalog and how CVEs work help decide what to fix first, especially for internet-facing systems.
What defenders can do
- Name an incident decision-maker and a deputy, and document who must be consulted before any contact with attackers.
- Identify legal counsel and, if applicable, your insurer’s notification process, and store the contact details offline.
- Decide in advance how you will handle law enforcement reporting, for example through CISA resources or IC3.
- Add a sanctions check to the response checklist and route it through counsel.
- Build and protect backups that are separate from normal administrative credentials, then test restoring them.
- Segment networks and review which accounts can reach backup and domain infrastructure.
- Run a tabletop exercise that includes an extortion demand, so leadership practises the decision before it is real.
- Keep patching and exposure management current, prioritising known-exploited vulnerabilities.
This list is general analysis, not legal advice. Adapt it to your jurisdiction, contracts and risk appetite.
Further reading
- CISA StopRansomware: the agency’s central page for ransomware resources and guidance.
- CISA Ransomware Guide: practical guidance on preventing and responding to ransomware incidents.
- FBI Internet Crime Complaint Center: where to report internet-enabled crime in the United States.
Explainers on Cyber Strike News
- What is CVSS? – how severity scores are built and what they miss
- What is EPSS? – the probability a flaw will be exploited soon
