A ransomware attack can hurt employee morale in unique ways compared to other types of attacks. Depending on how the company reacts, employee morale can drop, and security teams become less effective. While recovering from any malware incident can cost a significant amount of money, too many companies respond to ransomware by funding threat actors directly. There are many reasons not to pay a ransom. And too few organizations consider the cost of the psychological impact of paying.

The Cost of a Breach Versus a Ransomware Attack

According to the 2020 Costs of a Data Breach Report, the direct costs for ransomware are already higher than average for attacks. Many of us are aware of how breaches that affect our customers’ personally identifiable information (PII) can cost more in terms of damage to our reputations. We may not be thinking about how security incidents affect the people providing our security.

If a breach that impacts customers occurs, typically the company will respond with a huge investment to improve the company’s security posture. Affected businesses usually hire a lot more security talent. They’ll often purchase new security tools, too. And, companies shift strategies from being mostly reactive to a more proactive approach. For a security practitioner who makes it through a major incident, this change can feel like a huge relief. Money spent in the wake of a breach can go into fixing problems.

But, this is not always how things progress in the case of a ransomware attack.

Paying Criminals Costs More Than Money

Breaches and other security incidents certainly frustrate workers. But the nature of ransomware attacks can make a huge difference in how they affect morale.

Attacks that happen because of an unforeseen or rare issue are certainly unpleasant. But security practitioners face a whole different suite of frustrations if they’re trying to react to incidents rather than fighting them proactively. Likewise, morale can drop if company leaders don’t listen to employees’ warnings and then the exact issue they were warned about comes to pass. What hurts worst is when companies respond by rewarding attackers with money rather than spending that money to support workers doing their job well in the first place.

There can be other penalties for paying ransoms, too. Many security folks are keenly aware that ransomware gangs have been tied to nation-state threat actors. Ransomware payments can be used to fund actions that are harmful to national security. To combat this, the U.S. government is starting to crack down on consulting companies that help businesses pay ransoms. The U.S. Treasury’s Office of Foreign Assets Control recently warned that these companies could be prosecuted for paying ransoms even if they didn’t know that the attackers were sanctioned.

Being Reactive to a Ransomware Attack Hurts Morale

Let’s return to that idea of being reactionary. According to a survey by Sophos, a common thread among malware victims is that IT managers in affected organizations tend to focus less on prevention, and more on detection and response. This reactive approach can lead to lower morale among security experts who are not able to get ahead of new threats. It can also lead to managers having less trust in the abilities of their team. Reacting to incidents after the fact rather than preventing them certainly does not show anyone in their best light.

Teams who are constantly in a state of mopping up after incidents, rather than preventing them, are a very hard sell in a tight job market. These companies will have a very hard time attracting and retaining talent.

Paying rather than preventing ransomware attacks also puts you at a far greater risk of further incidents. According to a survey by Druva, half of all ransomware attack victims will be hit again. This is partly because threat actors mark these companies as ‘an easy mark’. It’s also likely that the affected companies have not fully addressed the issues that allowed them to be attacked in the first place. Companies hit by ransomware attacks may be less focused on the damage to their reputation than those hit by other breaches. Therefore, they’re less likely to make major efforts to fix issues.

It’s not hard to imagine why this would have a demoralizing effect on employees. Companies need to think about more than money when deciding whether to pay ransoms. They need to consider the cost in terms of the ongoing effectiveness of their security teams, as well.

More from Incident Response

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

Why federal agencies need a mission-centered cyber response

4 min read - Cybersecurity continues to be a top focus for government agencies with new cybersecurity requirements. Threats in recent years have crossed from the digital world to the physical and even involved critical infrastructure, such as the cyberattack on SolarWinds and the Colonial Pipeline ransomware attack. According to the IBM Cost of a Data Breach 2023 Report, a breach in the public sector, which includes government agencies, is up to $2.6 million from $2.07 million in 2022. Government agencies need to move…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today