The screen locks, the files are encrypted, and a note demands payment for the key. In that moment paying feels like the quickest route back to normal. It almost never is, and understanding why — before it happens — puts you in a far stronger position if it ever does.
What the payment does not guarantee
You are trusting criminals to keep their word. Sometimes the decryption key works; often it is slow, partial, or corrupts files on the way back. Paying also marks you as an organisation that pays, which is exactly the list you do not want to be on — repeat attacks on payers are common.
"Pay or we leak it" is a separate threat
Modern ransomware crews steal your data before encrypting it, then threaten to publish it. Paying to prevent a leak buys nothing you can verify: you have no way to confirm they deleted anything, and you have simply funded the next attack. The data is already out of your hands.
What actually gets you back on your feet
The organisations that recover well from ransomware have one thing in common, and it is not a bigger cheque book — it is backups they had tested.
- Backups that are offline or immutable. Ransomware hunts for connected backups and encrypts those too. A backup it cannot reach is the one that saves you.
- Backups you have actually restored from. A backup you have never tested is a hope, not a plan. Restore drills turn a crisis into a procedure.
- A written response plan. Who to call, how to isolate, how to communicate — decided in advance, not invented at 2am.
In the moment
Isolate affected machines from the network immediately, but do not power them off — memory holds evidence. Do not delete the ransom note; it identifies the strain, and for some strains free decryptors already exist. Then call your responders and, if you have cyber insurance, your insurer, before making any decision about payment. In several countries paying certain groups can itself carry legal risk, which is another reason the decision should never be made alone in a panic.
The honest headline: the best time to beat ransomware is months before it arrives, by making your backups something an attacker cannot touch. If you are not certain yours would survive an attack, testing that is the most valuable afternoon you could spend this quarter.