An Average Ransom Is Not an Expected Loss

“The average ransom is under $2 million. The average breach costs more. So paying, or insuring against paying, is the cheaper treatment.”

Let me stop you before that sentence reaches the board pack.

An average ransom is not your expected loss.

Security risk management sizes a treatment against expected loss.

Spend on the treatment when it costs less than the loss reduction it buys.

That arithmetic is fine.

The problem is the number being fed into it.

Coveware’s Q2 2026 figures put the average ransom payment at $1,880,612.

The median was $150,000.

Same quarter.

Same data.

The average was about 12.5 times the median, and it got there because a small number of unusually large, exfiltration-only payments dragged it upward.

That quarter they came mainly from one campaign against law firms, Silent Ransom/Luna Moth.

The average rose 176% from Q1 2026 while the median fell 50%.

One statistic went up and the other went down in the same three months.

If you run a regional manufacturer, a law-firm extortion campaign is not a description of your loss.

It is a description of somebody else’s tail.

Nobody would size a flood barrier on the average insured loss across every building in the country, including the ones on the coast.

Yet paste a ransom average into a spreadsheet and suddenly it is a planning figure.

1. “But Paying Is Cheaper Than Rebuilding.”

Cheaper than what, exactly?

That sentence compares a ransom with a rebuild, as though paying removed the rebuild.

It doesn’t.

The Hiscox Cyber Readiness Report 2025 found that 40% of companies that paid a ransom still failed to fully recover their data.

The failure modes are ordinary.

Decryptors from smaller or less-established operations are often simply broken.

Functional decryptors can be slow and unreliable at enterprise scale, failing on corrupted files or complex databases during multi-week runs.

And the backups you were counting on were frequently encrypted in the same attack, because finding and disabling backup infrastructure is now a standard step before encryption.

So the payment branch of your decision tree is not “pay R, done.”

It is “pay R, then some recovery work anyway.”

Here is the shape of it, with a deliberately crude assumption so the arithmetic is visible.

Call the ransom R and the cost of a full rebuild C.

Suppose that in the 40% of cases where payment does not fully recover the data, you end up paying for the rebuild regardless.

The expected cost of paying is then R + 0.4C.

Not R.

Paying is cheaper only while R + 0.4C is below C, which means R has to be below 0.6C.

The real partial-recovery cost may be smaller than a full rebuild, or larger if the decryptor wastes weeks first.

That is the point.

The comparison is between two distributions, and the payment branch has a recovery term in it.

And that is before the other half.

A CrowdStrike finding cited alongside the Hiscox data put the share of paying victims whose data was stolen regardless at 93%.

Payment addresses encryption.

It does not address exposure.

So whatever exposure costs you, it sits on both branches of the tree.

It is not a saving that the ransom buys.

2. “But the Average Breach Costs Millions, So the Premium Is a Bargain.”

Which average?

A widely cited estimate from 2016 analysis by Sasha Romanosky put the mean cost of a data breach to a targeted firm at around $5 million.

The median was closer to $200,000.

A factor of 25, derived by dividing one by the other.

The mean is inflated by a small number of extremely expensive breaches.

A treatment sized on the mean looks justified against almost any control cost.

A treatment sized on the median undervalues protection against exactly the tail the mean is capturing.

The two statistics mislead in opposite directions.

Neither answers your sizing question alone.

Now put a premium next to it.

Reported average annual premiums for US buyers in 2019 ran roughly $1,501 for $1 million of cover with a $10,000 deductible.

$1,146 for $500,000 with a $5,000 deductible.

$739 for $250,000 with a $2,500 deductible.

Against a $5 million mean, $1,501 looks like a clerical error.

But the $1 million policy covers, at most, one fifth of a loss that size.

The comparison that matters is not premium against a national average.

It is premium against the part of your own loss distribution the policy actually reaches.

Look at the shape of the prices too.

Doubling cover from $250,000 to $500,000 raised the premium about 55%.

Doubling again to $1 million raised it about 31%.

Premium scales with limit, not one-to-one, and those are 2019 figures that the market has since repriced.

GAO found take-up among surveyed clients rose from 26% in 2016 to 47% in 2020.

More than half of surveyed brokers’ clients saw premiums rise 10% to 30% in late 2020 alone.

GAO also found comprehensive loss data scarce, which is why insurers have repriced so aggressively as claims arrived.

A premium is a legitimate number to put against a mitigation spend.

Head to head, in the same routing decision.

It is the insurer’s price for its loss experience, not a measurement of yours.

3. “But the Negotiator Says This Group Delivers Working Decryptors.”

Good.

That is a real question, and professional negotiators research it before a client pays.

Established groups with an ongoing affiliate business to protect have a reputational incentive to ship working decryptors.

Smaller operations have no reputation to protect, and some disappear after payment.

So the negotiator’s answer is useful.

It conditions one branch of your distribution.

It narrows the probability that the decryptor fails outright.

It does not tell you whether a working decryptor finishes on your database estate in days or in weeks.

It does not tell you whether your backups survived.

And it says nothing about the 93%.

A group that reliably decrypts is still a group that took a copy of your data before it encrypted anything.

“This group delivers” updates one input.

It is not a replacement for the model the input goes into.

Notice what kind of information it is.

It is a probability about one party’s behaviour.

It is not a cost figure, and it does not turn an average ransom into your loss.

It makes one branch of the tree a little more likely to end well, and leaves the rest of the tree exactly as expensive as it was.

4. “But Most Victims in Our Sector Pay.”

Some sectors do.

Sophos’s 2026 survey of 2,158 organizations hit by ransomware found 72% of local and state government victims paid.

Retail: 32%.

Across victims generally, the rate has been falling for years.

Coveware tracked a payment rate near 85% in 2019.

28% in Q1 2024.

25% by Q4 2024.

Chainalysis estimated about 28% of victims paid in 2025, an all-time low.

Over the same year, victims claimed on leak sites rose 50% to a record 7,874, while total on-chain payments fell 8% to roughly $820 million.

More victims.

Less money.

Coveware attributes the decline to better backup and recovery practice, legal and regulatory pressure not to pay, and criminals repeatedly failing to honour deletion promises.

A payment rate describes what other organizations chose.

It is not a price.

It does not tell you whether paying was cheaper for them, and it certainly does not tell you whether it would be cheaper for you.

Meanwhile the median payment Chainalysis measured on-chain rose 368% to $59,556 in 2025.

Coveware’s Q2 2026 median was $150,000.

Sophos’s 2026 survey median payment was $769,000.

Three medians, and the largest is roughly 13 times the smallest.

They measure different populations: on-chain payments across a year, one firm’s cases in one quarter, and a survey of organizations that were hit.

Pick one without naming its population and you have chosen your answer before doing the arithmetic.

5. “But Our Register Already Scores Ransomware as High.”

Then you have a judgment.

Not a loss figure.

NIST SP 800-30 defines risk as a function of likelihood and impact, and leaves the combining algorithm to the organization.

It treats likelihood as compound.

The likelihood a threat event is initiated.

The likelihood that, once initiated, it succeeds given your vulnerabilities and predisposing conditions.

Each carries its own uncertainty.

A cell marked High records where somebody placed all of that on a coarse scale.

It does not say whether the impact behind it came from a mean, a median, or a headline.

So it cannot tell you whether a $1,501 premium, a negotiated payment or a new control costs less than the loss it avoids.

There is a second gap.

NIST SP 800-30 notes that when risks are coupled or correlated, their combined exposure can exceed the sum of their individually assessed worst cases.

It can exceed your capacity to absorb loss even when every individual risk was scored moderate.

In ransomware terms, that is shared backup infrastructure.

A single identity plane.

One event reaching every service that depends on either.

A register that scores ransomware per system and adds the rows has quietly assumed those systems fail independently.

The attacker has not agreed to that assumption.

And no score removes the uncertainty underneath it.

NIST SP 800-30 lists why that uncertainty is inherent.

The future may not resemble the past.

Knowledge of adversary tactics is incomplete.

Vulnerabilities in the products you run are still undiscovered.

Dependencies you have not recognized create impact paths nobody drew.

Unrecognized dependencies are precisely where coupled ransomware losses come from.

A published average cannot see any of them, because it was never about your estate.

6. “But Quantitative Modeling Is Too Expensive for an Organization Our Size.”

Sometimes it is.

NIST SP 800-30 says so plainly: the benefits of quantification can be outweighed by the cost in expert time and the tooling needed to make such assessments.

The cost sits in analyst time to produce and defend calibrated frequency and magnitude ranges, and in tooling to store and combine them.

Open FAIR certification is delivered through accredited training providers, with no single published price.

And quantitative adoption is additive.

It sits on top of whatever the qualitative program already costs.

Practitioners genuinely disagree about where the crossover lies.

One side holds that qualitative bins are cheap enough to apply consistently across a whole portfolio.

The other holds that they are systematically miscalibrated, and that their cost advantage disappears once you count the cost of acting on the wrong priority.

Neither position is settled.

But this is not a choice between a Monte Carlo platform and a coloured cell.

Writing “mean $1.88 million, median $150,000, Q2 2026, Coveware cases” instead of “average ransom $1.9 million” costs one line.

Asking which of your services share a backup system costs one meeting.

Pricing recovery separately from the ransom costs one extra column.

None of that needs a certification.

7. No, This Does Not Mean Averages Are Useless or Paying Is Never Rational.

It doesn’t.

Averages are evidence.

They show how heavy the tail is when they sit next to a median.

Established groups do have a reputational incentive to ship working decryptors.

Some victims have no better path, and paying is the least-bad treatment available on the day.

The claim is narrower.

The decision has to name the statistic it uses.

It has to name the distribution that statistic came from.

And it has to price separately what a payment does not buy: the recovery work in the 40%, and the exposure in the 93%.

Averages also date fast.

Payment rates, averages, medians and survey results are all evidence from a specific quarter or year.

A figure that was true for Q2 2026 is not a constant.

8. What You Should Actually Do

Build the loss distribution for your own services. Not the market’s.

Which services stop, for how long, and what that costs you, at a typical outcome and at a bad one.

A full loss-distribution output, such as a loss exceedance curve, is more useful for sizing a specific treatment than any single summary figure.

Report mean and median together whenever a cost figure enters a decision. State the population and period with them.

If someone brings a single “average”, ask which one.

Price recovery separately from any ransom. Put the rebuild, forensics, legal and downtime costs on the payment branch as well as the non-payment branch.

Sophos put the average total recovery cost at $1.7 million per incident in its 2026 survey.

That is also a mean, from a survey population, and it goes in the same caution as every other average here.

Write into the playbook that payment addresses encryption, not data exposure. Then price the exposure on both branches.

Compare premium against the part of your distribution the policy reaches. Limit, deductible and exclusions, not a national average breach cost.

Identify coupled risks. Shared backup infrastructure, a single identity plane, any common dependency that lets one event hit several services at once.

Model those as one event, not several independent ones.

9. The Actual Model Is Not Complicated.

Risk is a function of likelihood and impact, estimated under uncertainty that treatment never removes.

Impact is a distribution, and in this field it is heavily skewed.

A mean is dragged by the tail.

A median ignores it.

A payment changes the distribution, but it does not collapse it to the ransom.

Your expected loss is built from your services, your dependencies and your distribution. A published average is built from someone else’s.

Use the averages.

Use the medians.

Use the payment rates.

Put the date and the population next to each one.

Then size the decision against the loss you would actually take.

Not against the quarter a law-firm campaign happened to land in somebody’s dataset.