The public discussion of ransomware payment is often binary — pay or don’t pay, with strong views on both sides. The reality of decisions in actual incidents is more complex. Organizations weigh many factors, often under time pressure, with incomplete information.

The 2026 environment has shifted both the threat and the response landscape. Here’s how payment decisions actually get made.

The factors organizations actually consider

When an organization faces a ransomware demand, the relevant factors include:

Recoverability of operations without payment. Are backups intact and recent? Can systems be rebuilt? How long would recovery take? What’s the operational cost of extended downtime?

Data sensitivity. Is the leaked data the organization’s intellectual property, customer data, employee data, or third-party data? Different categories have different risk profiles.

Regulatory requirements. What are the disclosure obligations? What are the implications of paying versus not paying for regulatory and legal exposure?

Insurance considerations. What does the cyber insurance policy cover? What does the insurer recommend? What are the implications for the policy if payment is or isn’t made?

Sanctions and legal exposure. Is the threat actor on a sanctions list? What’s the risk of legal exposure for paying?

Mission-critical considerations. For some organizations (hospitals, infrastructure operators), extended downtime has consequences beyond commercial. The calculus is different.

Long-term reputational impact. How will the decision affect customer trust, regulator perception, and organizational reputation?

What the law actually says

The legal framework around ransomware payments in Australia in 2026 has clarified somewhat:

• Payment to entities on Australia’s autonomous sanctions list creates legal exposure
• The Cyber Security Act 2024 created notification requirements for ransomware payments
• Payments above specific thresholds need to be reported to designated authorities
• The legal restrictions don’t make payment illegal in most cases but they create compliance overhead

The practical effect is that organizations facing payment decisions typically engage external counsel and forensics partners specifically to navigate the legal and compliance dimension.

What insurance is doing

Cyber insurance in 2026 has evolved on ransomware specifically:

• Most policies cover ransomware payment subject to conditions
• Many policies require insurer involvement in payment decisions
• Some policies have moved away from covering payments toward covering recovery costs only
• Premiums and deductibles have risen significantly in response to claim volumes
• Underwriting requirements have tightened

Organizations relying on insurance to fund payments find that the insurance experience is more involved than they expected. Insurers participate actively in incident response, including in negotiation with threat actors when payment is being considered.

The negotiation reality

When organizations do enter into negotiations (typically through specialist firms rather than directly), the dynamics include:

Time pressure works in both directions. Threat actors typically want to close deals quickly. Organizations may want time to evaluate alternatives. The timeline pressure isn’t symmetric.

Discount expectations. Most ransomware demands are negotiated significantly downward. Initial demands are typically anchored high to provide negotiating room. Final payments are often 20-50% of initial demands.

Decryption tool reliability. Even after payment, the decryption tools provided are sometimes incomplete or buggy. The expectation that payment automatically restores operations isn’t always accurate.

Re-extortion risk. Some threat actors return for additional payment after initial payment. The reputation of specific groups for honoring deals affects negotiation dynamics.

Data leak follow-through. When data leak is part of the threat, organizations have to consider whether payment will actually prevent leak. Some groups leak data anyway. The reliability of “we’ll delete the data” claims is low.

What organizations decide

The actual decision distribution in 2026:

• Approximately 35-45% of affected organizations pay (down from earlier estimates)
• Larger organizations are more likely to pay than smaller (more capacity, more at stake)
• Highly regulated sectors (healthcare, finance) have specific patterns
• Organizations with strong backup and recovery capability are less likely to pay
• Attribution to sanctioned groups significantly reduces payment likelihood

The trend has been gradual reduction in payment rates over time, partly due to better preparation and partly due to legal and regulatory pressure.

What helps organizations decide well

Organizations that navigate ransomware decisions well share patterns:

Pre-incident preparation. Tabletop exercises, written response plans, pre-negotiated relationships with incident response firms. Organizations that prepare in advance make better decisions under pressure.

Clear decision authority. Who actually decides whether to pay? In a real incident, this needs to be clear before the incident, not negotiated during.

Specialist support. Most organizations don’t have in-house ransomware response expertise. External support is essential for incidents at any scale.

Realistic operational assessment. Understanding actual recovery capability rather than the theoretical recovery capability per the disaster recovery plan.

Ethical and reputational considerations explicit. Organizations that have thought through these questions before the incident make more consistent decisions.

What organizations should do now

If you haven’t been hit by ransomware:

• Test your backup and recovery for actual ransomware scenarios, not just system failure
• Engage with cyber insurance to understand what’s covered and what’s required
• Establish relationships with incident response firms before you need them
• Run tabletop exercises that include ransomware scenarios
• Document the decision-making process you would use in advance
• Train relevant staff on incident response

If you have been hit by ransomware:

• Engage specialist response support immediately
• Engage external counsel
• Notify insurers per policy requirements
• Document everything for regulatory and insurance purposes
• Take the time needed to make a good decision rather than rushing under pressure
• Plan post-incident hardening as part of response, not after

The ransomware threat continues. The defensive and decision frameworks have improved. The right answer for any specific incident depends on the specific circumstances. Generic advice doesn’t substitute for specific assessment.

For most organizations the goal is to make the choice less binary by maintaining recovery capability that makes payment optional. That preparation is the highest-use investment available.