In This Article
Although many businesses collectively spend billions on cybersecurity defenses every year, the threat ransomware poses to businesses is not slowing down. However, cyber attacks are growing at a much faster pace than ever before.
According to the newly released Veeam 2025 Ransomware Trends and Proactive Strategies Report, almost 70% of businesses and organizations were hit by some kind of ransomware attack during the past year. Although the security has been significantly enhanced.
This clearly shows that preparations are not enough to protect businesses from cyberthreats. Resilience needs to be built into every organization’s data strategy.
“Organizations are improving their defenses against cyber-attacks, yet 7 out of 10 still experienced an attack in the past year,” said Anand Eswaran, CEO of Veeam. “And of those attacked, only 10% recovered more than 90% of their data, while 57% recovered less than 50%. Our latest findings clearly indicate that the threat of ransomware will continue to challenge organizations throughout 2025 and beyond. As the nature and timing of attacks evolve, it is essential for every organization to transition from reactive security measures to proactive data resilience strategies.”
Interestingly, this year’s Veeam report brings industry insights from 1,300 CISOs, security professionals, and IT leaders across the Americas, Europe, and Australia. The experiences of each company reveal a truth that makes the people of this industry uncomfortable.
While ransomware attack rates have dropped slightly, from 75% to 69%, the damages and destruction caused by these incidents remain devastating for many.
How Businesses Can Protect Themselves from Ransomware Attacks
The key behind protection is to implement a multi-layered security approach. Here are the strategies businesses can follow and implement proactive measures to reduce the probability of falling victim to ransomware attacks:
Implement Strong Cybersecurity Practices
- Install and Maintain Antivirus and Anti-Malware Software: Use comprehensive endpoint protection solutions with behavior-based detection to identify and block ransomware. Keep these solutions updated.
- Implement Network Segmentation: If one area is compromised, divide the network into isolated segments to limit the spread of ransomware.
- Strong Password Policies: Enforce complex passwords and multi-factor authentication (MFA) for all accounts.
- Regular Security Awareness Training: Educate employees about phishing, malicious links, and other common ransomware attack vectors. Conduct regular training and simulations.
- Keep Systems and Software Updated: Patch operating systems, applications, and firmware regularly to address known vulnerabilities. Enable automatic updates where possible.
- Use Firewalls: Configure firewalls to monitor and control incoming and outgoing network traffic, blocking suspicious activity.
Risk Assessment and Management
- Consider Cyber Insurance: Evaluate cyber insurance options to help cover the costs of a ransomware attack, such as recovery, legal fees, and business interruption.
- Identify Vulnerabilities: Regularly assess potential risks and vulnerabilities in the IT infrastructure.
- Monitor Networks: Implement tools and processes to monitor networks for suspicious activity and potential intrusions.
Robust Data Backup and Recovery Plan
- Secure Backups: To prevent backups from being encrypted during an attack, store them in a safe, isolated location that is not easily accessible from the primary network. Consider air-gapped or immutable storage.
- Regular Backups: Implement a consistent backup schedule for critical data. Follow the 3-2-1 rule: keep at least three copies of your data, on two different storage types, with one copy stored offsite and ideally immutable (cannot be altered or deleted).
- Test Backups Regularly: Conduct disaster recovery tests to ensure that backups are functional and can be restored efficiently.
Incident Response Plan
- Develop a Plan: Create a detailed plan outlining the steps to take in the event of a ransomware attack. This should include roles and responsibilities, communication protocols, and recovery procedures.
- Practice the Plan: Conduct tabletop exercises and simulations to ensure the team is prepared to respond effectively.
Evolving Threats, Shifting Tactics
In 2024 alone, law enforcement agencies around the world made headlines by disassembling BlackCat and LockBit, which are considered to be among the most important ransomware operations. At the same time, instead of entirely crushing the threat, these efforts broke it into smaller pieces and groups.
These reduced, decentralized groups and the so-called “lone wolves” have taken up the veil, retaining even more volatile and targeted tactics. The result, you might ask, is a more scattered and difficult-to-track threat landscape.
A quick fact that has been found in the report that has been disturbing the business owners and the whole IT sector is the increase in exfiltration-only attacks. For those who couldn’t figure it out, this means that instead of locking up data behind encryption, attackers directly steal the data, while bypassing most traditional detection tools. This has been an open threat for companies that can be resold or exposed publicly.
Attacks like these are so powerful that they can exploit vulnerabilities within hours of being discovered, which puts organizations with below-average detection capabilities at a much greater risk.
The Decline of Ransom Payments and the Rise of Consequences
We have noticed in the reports that the overall value of ransom payments has decreased significantly. Last year, over 36% of the organizations that were attacked by ransomware completely refused to pay. We believe those companies must have had a good backup and restoration system in place.
As far as those who did pay to recover their data, the data suggests that over 60% of those attacked paid less than half of the amount that was originally demanded by the attacker, which is then followed by the recovery assistance or further negotiations by the team.
This trend, as we can clearly see, aligns with the ever-growing global pressure from initiatives like the International Counter Ransomware Initiative. An enterprise that is designed to encourage resilience rather than pay for the ransom.
Moreover, another clearly noticeable aspect is the legal framework, which has been catching up as well. The newly defined regulations are designed to discourage ransom payments, which further suggests that prevention of ransomware attacks and recovery from them are no longer strategic priorities; they are actually the controlling rules.
Why Collaboration is Key
Have you ever considered collaboration and how it can be a solution? The report points out that the collaborative approach is a foundational element of resilience.
Those organizations that aim to endorse stronger cross-functional partnerships between the security team members and the IT members, along with stronger relations with law enforcement agencies and third-party experts, have managed to perform significantly better during the attacks.
In fact, companies and corporations that collaborated with the IT team were able to lower their recovery times while experiencing significantly minimal data loss.
At the same time, in spite of the best intentions, misalignment continues to exist within the industry. For instance, although 98% of the organizations surveyed in the report claimed to have a ransomware playbook, fewer than half included critical technical protocols like verified backup testing, which accounts for 44%, or a clearly defined chain of command, which accounts for 30%.
Even more telling: Post-attack confidence plummeted. While 69% of organizations believed they were prepared before an attack, that confidence dropped by over 20% after the incident. CIOs experienced the steepest drop, 30%, compared to a 15% decline among CISOs, indicating that security leaders may have a more realistic understanding of their organizational vulnerabilities.
Radical Resilience: The Next Cybersecurity Frontier
You must be wondering about the key differences between organizations that manage to recover quickly from cyber attacks and those that aren’t able to.
According to the reports released by Veeam, it all boils down to radical resilience. This means companies follow an integrated and proactive approach to protecting their data while focusing on overall security, which goes way beyond the point of patching and firewall setups.
There are organizations that are following mature data resilience strategies, and those are the same organizations that managed to recover from attacks up to seven times faster than those that were less prepared to withstand such attacks.
What’s interesting to note here is that these organizations incorporated the 3-2-1-1-0 rule. The system maintains three copies of data, and those copies are located in two different media locations. One is off-site, and the other is immutable, which means it is protected from any changes, the backups won’t be affected, and it will remain error-free.
This smartly built framework guarantees that you will not only be able to fully recover your data but also gives confidence to the IT team regarding the integrity of the data once it has been restored to the main system in the event of a ransomware attack.
Moreover, regarding the budgeting for recovery and security, the report shows an upward trend as companies and organizations have been actively spending to protect and secure their data. However, spending is not enough.
Veeam stresses that the investment must be specifically targeted towards the right approach. While at the same time, priority should not be limited to the defenses but should be smartly distributed in the recovery and testing protocols, capabilities to detect threats, and regular training and exercises being conducted by both executive and IT teams.
Concluding Thoughts
With every passing day, ransomware has grown into a much more complex and bolder security threat for companies and organizations. This shows that the days of a reactive cybersecurity approach are numbered. What organizations and IT teams need to work on now is proactive data resilience driven by hardened defenses, relentless testing, and an organization that understands that every company and its data is a target.
Those companies who are determined to truly lead in this year, for them the directive is clear, which is to build resilience into every layer of your operations, while thoroughly testing your recovery plans, and breaking down silos between security and IT while continuing to operate with the urgency that these security threats demand.
The reason is that data is no longer just an asset for companies; it has become a battlefield. Only those organizations that prepare for the worst will be able to emerge stronger after an attack.
