BlackFog's 2022 research puts the average direct ransom payout at $258,143, up sharply on the prior quarter. That figure does not include lost business, rebuild costs, or regulatory fines, so the real cost of a ransomware event is several times higher.
The argument from BlackFog is worth taking seriously: enterprise ransomware protection has to assume the attacker gets in, because at current volumes they will. The job is to stop the next stage, which is data leaving the building.
What happened:
- BlackFog reports the average direct ransomware payout is $258,143, climbing quarter-on-quarter.
- Earlier IDC data cited by BlackFog said 37% of organisations worldwide were hit by ransomware in a 12-month period.
- Most victims paid something, either to restore access or to suppress a leak.
- A modern defence stack should include backups, anti-malware, training, endpoint protection, and anti-data exfiltration.
- Perimeter-only thinking is no longer enough; assume breach and focus on the data.
The case for layered ransomware defence
Ransomware has moved on. The classic version encrypted a server and demanded payment for the key. The current version steals the data first, then encrypts, then publishes if you do not pay. Double extortion, and increasingly triple extortion with DDoS or harassment, has rewritten the playbook. Defences that only stop encryption are missing the larger pressure point.
BlackFog lays out the components of a layered approach, and it is a familiar list: data backups that are isolated and tested, anti-malware on every endpoint, recurring user training, and endpoint protection that covers devices outside the traditional network. The new ingredient, and the one BlackFog sells, is anti-data exfiltration, which aims to block the outbound flow of sensitive data in real time.
The framing is important. Perimeter controls still matter, but they are no longer the load-bearing wall. Once an attacker is inside, the only thing that stops the ransom from being effective is denying them the use. That means either recovering data quickly from backups or preventing the exfiltration that gives the leak threat any teeth.
Our analysis
The most useful sentence in BlackFog's piece is also the most uncomfortable: by the time a business knows it has been hit, it is often too late to prevent the worst outcomes. That is true of encryption-only attacks and even more true of double-extortion cases. The decision to pay is made under duress, with the leak threat sitting in front of the CFO.
Who benefits? Attackers, who have built a reliable monetisation engine. Who loses? Any organisation still buying ransomware protection as a single product rather than a layered outcome. The classic EDR-versus-antivirus debate misses the point. You need both, plus backups, plus exfiltration controls, plus tested recovery.
The other thing the data hides is the long tail. The average payout reported by BlackFog is already large, and we have all seen headline cases many multiples higher. The average is not the planning number. For a realistic budget conversation, plan around the worst case you cannot survive, not the median case the industry reports.
What it means for you
Say you are the CISO of a mid-sized company. You have EDR, you have backups, you have user training. The next thing to test is whether your exfiltration controls actually work. Pick a representative workload, simulate a data theft using a non-malicious tool, and see what your stack does. If the data leaves without a meaningful alert, you have your gap.
Then look at your backup architecture. Are backups immutable? Are they reachable from the production environment, and could a compromised admin account encrypt or delete them too? The number of ransomware cases that succeeded because backups were reachable is too high to ignore. Air-gap or identity-segregate them.
Finally, pressure-test the ransom decision now. Board, legal, finance, and security need a written playbook that answers the basic question: under what circumstances, if any, do we pay? Without that, the decision gets made in a panic, in the middle of the night, by the people who happened to be on call.
Bottom line
Antivirus alone will not save you. Neither will EDR alone. The minimum modern stack is layered, and the new must-have is anti-data exfiltration. Plan for the worst case, not the average, and rehearse the ransom decision before you have to make it.
Key takeaways
- Average ransom payouts keep climbing, so budget for the worst case, not the median.
- Double-extortion means stopping encryption is no longer enough; you also need to stop data leaving.
- Layered defences (backups, EDR, training, exfiltration controls) beat single-product thinking.
- Backups must be immutable and isolated, or they will be hit too.
- Make the ransom decision in advance, on paper, with the board.
Frequently asked questions
What is the average ransomware payout right now?
BlackFog's 2022 research puts the average direct payout at $258,143, up from the previous quarter.
What is double extortion in ransomware?
It is when attackers steal data before encrypting systems, then threaten to publish the data if the ransom is not paid.
Is antivirus still enough on its own?
No. Modern ransomware defences are layered and include endpoint protection, immutable backups, user training, and anti-data exfiltration.
Why is anti-data exfiltration important?
Because most modern ransomware crews rely on the threat of leaking data to force payment; if the data cannot leave, that use is gone.
Should we plan to pay a ransom if hit?
That is a board-level decision, but it should be made in advance, in writing, with legal, finance, and security input, not in the middle of an incident.
Inspired by reporting from: blackfog.com