Sophos
Annual state-of-ransomware report based on an international survey of organisations. Measures attack rate, payment frequency, ransom amounts, recovery cost and time, and the role of backups and insurance in recovery. Bridges threat and economic consequence.
Self-reported survey of several thousand IT and security leaders across many countries and sectors. Amounts are self-declared and depend on respondent recall; the sample is built for sector representativeness but remains an opinion survey.
Use to connect attack probability, payment behaviour and recovery cost within a single frame. Useful for documenting the role of backups and coverage in loss containment.