Ransomware Payouts Decline as Defenses Strengthen, But Threat Actors Adapt A new report from cyber insurance provider Coalition reveals a sharp decline in ransomware payouts, signaling improved resilience among enterprises. In 2025, only 14% of policyholders paid ransoms down from 44% in 2024 despite attackers maintaining average demands of $1 million. The shift reflects stronger defenses, including robust backups, incident response plans, and proactive security measures. The findings align with Chainalysis’ 2026 Crypto Crime Report, which noted a drop in total on-chain ransomware payments last year. Researchers attributed the decline to better incident response, regulatory pressure, law enforcement crackdowns on ransomware groups, and the fragmentation of ransomware-as-a-service (RaaS) operations, leading to smaller, less coordinated attacks. However, threat actors are evolving their tactics. Triple-extortion schemes where attackers encrypt data, exfiltrate it, and threaten to leak it to victims’ customers or employees are becoming more common. Some groups have even adopted quadruple extortion, filing complaints with regulators like the SEC against victims for delayed breach disclosures to increase pressure. AI is reshaping the ransomware landscape, enabling attackers to automate and scale operations while targeting both large enterprises and smaller businesses. On the defensive side, security teams are leveraging AI to prioritize vulnerabilities, detect anomalies, and respond faster to threats. While ransomware remained the costliest cyber claim in 2025 (averaging $269,000 per incident), business email compromise (BEC) and funds transfer fraud (FTF) dominated overall, accounting for 58% of incidents. BEC claims rose 15% year-over-year, with average losses increasing 28% to $27,000, often serving as a precursor to more severe attacks like FTF. Remote access tools particularly VPNs (59% of ransomware entry points) and remote desktop applications (14%) remain prime targets. Managed security service providers (MSSPs) play a critical role in securing these vectors through continuous monitoring, identity protections, and timely patching. Coalition’s incident response team also demonstrated success in reducing ransom demands by 65%, negotiating average payouts down from $873,000 to $355,000. The data underscores a shifting dynamic: while ransomware remains a major threat, stronger defenses and declining payouts may force attackers to adapt further potentially increasing the use of AI-driven attacks and multi-layered extortion tactics.