Cost of ransomware recovery too high? Here’s how to stop footing the bill | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

Cost of ransomware recovery too high? Here’s how to stop footing the bill

Reducing ransomware recovery costs through stronger organizational resilience

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

It’s no secret that recovering from a ransomware attack can be costly.

Last year, ransomware attacks cost organizations globally an estimated

57 billion, and this already eye-watering figure is expected to jump to

275 billion by 2031.

Unfortunately for organizations, ransomware attacks are no longer a question of if or when, but rather how many times they will occur.

But while you might not always be able to prevent incoming ransomware attacks completely, what organizations can consistently control is how they respond. And this response will have a big impact on your final ‘ransomware bill’ when the dust has finally settled.

The many financial factors here include: do you have immutable backups in place (or do you have to consider paying the ransom), how long are operations offline, and is any data lost permanently? So, it's not just a question of ‘can you recover?’ but ‘how well can you recover?’.

Most ransomware attacks are opportunistic. Here’s how you can stop attackers

British businesses still aren’t bouncing back from cyberattacks – here’s how to tackle the problem

Backups won’t save you from this version of ransomware

So how can you address this and trim down that bill?

First, organizations need to understand how they got here. Traditionally, the responsibility for cyber resilience and ransomware would have sat squarely in the hands of the security team. But in today’s digitally connected world, the responsibility for ransomware protection and recovery needs to extend further.

Despite this, many organizations are yet to get the memo. In fact, over half of organizations reported last year that they needed a significant overhaul of their IT operations and security team alignment.

They continue to focus all of their ransomware recovery planning within the security team, meaning that when attacks do occur, they’re left scrambling to coordinate with the rest of the organisation. The result? Deadly misalignment that drags out recovery times - and costs.

Take the spate of high-profile retail ransomware attacks across the UK last year. After the dust had settled, the numbers were tallied up, with estimated costs just shy of half a billion.

Reported ransomware incidents are just the tip of the iceberg

When cyberattacks are inevitable, recovery becomes the strategy

When confidence becomes a risk: The gap between cyber resilience readiness and reality

This wasn’t just due to the IT costs; it was a result of the lengthy downtime the incident caused, with services across the business left out of action, or significantly reduced for months afterwards. It didn’t just cost the victim valuable sales; it also had a knock-on effect on their suppliers, disrupting their business too.

It’s not that these organizations didn’t have data recovery plans; it’s that they couldn’t implement them fast enough. And in a ransomware attack, time is quite literally money - the highest direct cost of downtime is lost revenue.

On paper, your security and IT infrastructure teams might have interconnected plans, but if your security team is the only one regularly testing and refining their plans, then those connections will fail. In practice, these teams might well be trying to work together, but security teams will likely be left trying to pick up all the slack, and there’s only so much that a security team can handle. Despite their best efforts, it will have a knock-on effect on downtime and overall recovery time.

This disconnect has already been recognized by regulations such as NIS2 and DORA across the EU, which both place increased responsibility for recovery and resilience on the shoulders of senior leadership, not just security teams. So why wait?

Admittedly, it is easier said than done to align ransomware recovery across all of your relevant business teams. But it’s worth the effort. You might spend big on the best-in-class security and recovery tools, but they don’t define your resilience - it’s all about how you use them.

Technology needs to be aligned with wider business strategy, your people, and your processes. Yes, invest in high-quality tools, but don’t neglect investment in your training and preparation. It’s not about throwing more money at the problem; it’s about spending it in the right place.

Spreading investment more evenly across the board might end up costing you a little more in the short term, but done right, it’s an investment that won’t just pay for itself; it’ll drive additional revenue too.

We’ve already seen that organizations with better resilience, characterized by this approach, don’t just perform better on paper; they perform better in profits too, with a 10% higher average revenue growth rate.

Organizations with mature resilience don’t just recover 30% faster from ransomware, but their downtime costs are 2x lower on average. The way forward is clear - organizations just need to take that first step.

Unless organizations change their approach to ransomware recovery, these costs will keep mounting. Ultimately, your security stack can only get you so far without empowered teams and standardized execution of resilience measures to match. Otherwise, in times of crisis, you’ll be scrambling to respond when you should be acting decisively.

It can be hard to know where to start, but tools such as Data Resilience Maturity Models can help here. They assess your current levels of preparedness and produce practical guidelines to turn your current tools and your talented teams into a fully aligned ransomware recovery strategy.

Tying your resilience directly into business strategy to ensure threats are anticipated, governance is enforced, and compliance is met and maintained. And most importantly, ensuring that you’re not spending more on ransomware recovery than you need to.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

You must confirm your public display name before commenting

1‘We tore it to the ground’: Apple says it built Siri AI ‘from the ground up’, but admits this wasn't the original plan — a first version of its new voice assistant was ready last year

2 The latest 2026 Razer Blade 18 is a monster of a gaming laptop that annihilates the competition – if you can afford the price of admission

3 Salesforce snaps up customer service software giant Fin for $3.6bn

4 This is where magic gets real — can you ace our 30 question ultimate Disney quiz on Mickey, Marvel, Star Wars and more?

5 Philips Hue unveils new Play lamps and upgraded candle bulbs — plus switches that can bring Hue power to traditional and fancy light fixtures

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards