A ransomware attack can hurt employee morale in unique ways compared to other types of attacks. Depending on how the company reacts, employee morale can drop, and security teams become less effective. While recovering from any malware incident can cost a significant amount of money, too many companies respond to ransomware by funding threat actors directly. There are many reasons not to pay a ransom. And too few organizations consider the cost of the psychological impact of paying.

The Cost of a Breach Versus a Ransomware Attack

According to the 2020 Costs of a Data Breach Report, the direct costs for ransomware are already higher than average for attacks. Many of us are aware of how breaches that affect our customers’ personally identifiable information (PII) can cost more in terms of damage to our reputations. We may not be thinking about how security incidents affect the people providing our security.

If a breach that impacts customers occurs, typically the company will respond with a huge investment to improve the company’s security posture. Affected businesses usually hire a lot more security talent. They’ll often purchase new security tools, too. And, companies shift strategies from being mostly reactive to a more proactive approach. For a security practitioner who makes it through a major incident, this change can feel like a huge relief. Money spent in the wake of a breach can go into fixing problems.

But, this is not always how things progress in the case of a ransomware attack.

Paying Criminals Costs More Than Money

Breaches and other security incidents certainly frustrate workers. But the nature of ransomware attacks can make a huge difference in how they affect morale.

Attacks that happen because of an unforeseen or rare issue are certainly unpleasant. But security practitioners face a whole different suite of frustrations if they’re trying to react to incidents rather than fighting them proactively. Likewise, morale can drop if company leaders don’t listen to employees’ warnings and then the exact issue they were warned about comes to pass. What hurts worst is when companies respond by rewarding attackers with money rather than spending that money to support workers doing their job well in the first place.

There can be other penalties for paying ransoms, too. Many security folks are keenly aware that ransomware gangs have been tied to nation-state threat actors. Ransomware payments can be used to fund actions that are harmful to national security. To combat this, the U.S. government is starting to crack down on consulting companies that help businesses pay ransoms. The U.S. Treasury’s Office of Foreign Assets Control recently warned that these companies could be prosecuted for paying ransoms even if they didn’t know that the attackers were sanctioned.

Being Reactive to a Ransomware Attack Hurts Morale

Let’s return to that idea of being reactionary. According to a survey by Sophos, a common thread among malware victims is that IT managers in affected organizations tend to focus less on prevention, and more on detection and response. This reactive approach can lead to lower morale among security experts who are not able to get ahead of new threats. It can also lead to managers having less trust in the abilities of their team. Reacting to incidents after the fact rather than preventing them certainly does not show anyone in their best light.

Teams who are constantly in a state of mopping up after incidents, rather than preventing them, are a very hard sell in a tight job market. These companies will have a very hard time attracting and retaining talent.

Paying rather than preventing ransomware attacks also puts you at a far greater risk of further incidents. According to a survey by Druva, half of all ransomware attack victims will be hit again. This is partly because threat actors mark these companies as ‘an easy mark’. It’s also likely that the affected companies have not fully addressed the issues that allowed them to be attacked in the first place. Companies hit by ransomware attacks may be less focused on the damage to their reputation than those hit by other breaches. Therefore, they’re less likely to make major efforts to fix issues.

It’s not hard to imagine why this would have a demoralizing effect on employees. Companies need to think about more than money when deciding whether to pay ransoms. They need to consider the cost in terms of the ongoing effectiveness of their security teams, as well.

More from Incident Response

SOCs Spend 32% of the Day On Incidents That Pose No Threat

4 min read - When it comes to the first line of defense for any company, its Security Operations Center (SOC) is an essential component. A SOC is a dedicated team of professionals who monitor networks and systems for potential threats, provide analysis of detected issues and take the necessary actions to remediate any risks they uncover. Unfortunately, SOC members spend nearly one-third (32%) of their day investigating incidents that don't actually pose a real threat to the business according to a new report…

4 min read

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Expert Insights on the X-Force Threat Intelligence Index

5 min read - Top insights are in from this year’s IBM Security X-Force Threat Intelligence Index, but what do they mean? Three IBM Security X-Force experts share their thoughts on the implications of the most pressing cybersecurity threats, and offer guidance for what organizations can do to better protect themselves. Moving Left of Boom: Early Backdoor Detection Andy Piazza, Global Head of Threat Intelligence at IBM Security X-Force, sat down with Security Intelligence to chat with us about the rise in the deployment…

5 min read