A ransomware attack can hurt employee morale in unique ways compared to other types of attacks. Depending on how the company reacts, employee morale can drop, and security teams become less effective. While recovering from any malware incident can cost a significant amount of money, too many companies respond to ransomware by funding threat actors directly. There are many reasons not to pay a ransom. And too few organizations consider the cost of the psychological impact of paying.

The Cost of a Breach Versus a Ransomware Attack

According to the 2020 Costs of a Data Breach Report, the direct costs for ransomware are already higher than average for attacks. Many of us are aware of how breaches that affect our customers’ personally identifiable information (PII) can cost more in terms of damage to our reputations. We may not be thinking about how security incidents affect the people providing our security.

If a breach that impacts customers occurs, typically the company will respond with a huge investment to improve the company’s security posture. Affected businesses usually hire a lot more security talent. They’ll often purchase new security tools, too. And, companies shift strategies from being mostly reactive to a more proactive approach. For a security practitioner who makes it through a major incident, this change can feel like a huge relief. Money spent in the wake of a breach can go into fixing problems.

But, this is not always how things progress in the case of a ransomware attack.

Paying Criminals Costs More Than Money

Breaches and other security incidents certainly frustrate workers. But the nature of ransomware attacks can make a huge difference in how they affect morale.

Attacks that happen because of an unforeseen or rare issue are certainly unpleasant. But security practitioners face a whole different suite of frustrations if they’re trying to react to incidents rather than fighting them proactively. Likewise, morale can drop if company leaders don’t listen to employees’ warnings and then the exact issue they were warned about comes to pass. What hurts worst is when companies respond by rewarding attackers with money rather than spending that money to support workers doing their job well in the first place.

There can be other penalties for paying ransoms, too. Many security folks are keenly aware that ransomware gangs have been tied to nation-state threat actors. Ransomware payments can be used to fund actions that are harmful to national security. To combat this, the U.S. government is starting to crack down on consulting companies that help businesses pay ransoms. The U.S. Treasury’s Office of Foreign Assets Control recently warned that these companies could be prosecuted for paying ransoms even if they didn’t know that the attackers were sanctioned.

Being Reactive to a Ransomware Attack Hurts Morale

Let’s return to that idea of being reactionary. According to a survey by Sophos, a common thread among malware victims is that IT managers in affected organizations tend to focus less on prevention, and more on detection and response. This reactive approach can lead to lower morale among security experts who are not able to get ahead of new threats. It can also lead to managers having less trust in the abilities of their team. Reacting to incidents after the fact rather than preventing them certainly does not show anyone in their best light.

Teams who are constantly in a state of mopping up after incidents, rather than preventing them, are a very hard sell in a tight job market. These companies will have a very hard time attracting and retaining talent.

Paying rather than preventing ransomware attacks also puts you at a far greater risk of further incidents. According to a survey by Druva, half of all ransomware attack victims will be hit again. This is partly because threat actors mark these companies as ‘an easy mark’. It’s also likely that the affected companies have not fully addressed the issues that allowed them to be attacked in the first place. Companies hit by ransomware attacks may be less focused on the damage to their reputation than those hit by other breaches. Therefore, they’re less likely to make major efforts to fix issues.

It’s not hard to imagine why this would have a demoralizing effect on employees. Companies need to think about more than money when deciding whether to pay ransoms. They need to consider the cost in terms of the ongoing effectiveness of their security teams, as well.

More from Incident Response

How to Start a Career in Cyber Incident Response

Cyber incident response is one of cybersecurity's most interesting and rewarding careers. It’s an in-demand role, and it pays well. But how do you get started? First, let’s start with the basics. What is Cyber Incident Response? Cyber incident response is the preparation for and practice of identifying, containing and ending cyber attacks. A computer security incident response team (CSIRT) within an organization — ideally including the chief information security officer, security operations center staff, executives and representatives from the…

How the Mac OS X Trojan Flashback Changed Cybersecurity

Not so long ago, the Mac was thought to be impervious to viruses. In fact, Apple once stated on its website that "it doesn't get PC viruses". But that was before the Mac OS X Trojan Flashback malware appeared in 2012. Since then, Mac and iPhone security issues have changed dramatically — and so has the security of the entire world. In this post, we'll revisit how the Flashback incident unfolded and how it changed the security landscape forever. What…

What Hurricane Preparedness Can Teach Us About Ransomware

Each year between June and November, many parts of the U.S. become potential targets for hurricanes. In October 2022, we had Hurricane Ian devastate Florida. To prepare for natural disasters like hurricanes, organizations are encouraged to build out and test business continuity, disaster recovery, and crisis management plans to use in the response efforts. Millions of dollars each year are spent on natural disaster preparation, but natural disasters are not the only disruption businesses face. While we can’t equate the…

Charles Henderson’s Cybersecurity Awareness Month Content Roundup

In some parts of the world during October, we have Halloween, which conjures the specter of imagined monsters lurking in the dark. Simultaneously, October is Cybersecurity Awareness Month, which evokes the specter of threats lurking behind our screens. Bombarded with horror stories about data breaches, ransomware, and malware, everyone’s suddenly in the latest cybersecurity trends and data, and the intricacies of their organization’s incident response plan. What does all this fear and uncertainty stem from? It’s the unknowns. Who might…