The real cost of ransomware is losing control of the business

For years, businesses have approached ransomware primarily as a cybersecurity problem. Invest in better defences, improve detection and stop attackers before they reach critical systems.

But the continuing willingness of organisations to pay ransomware demands suggests another problem is at play: when an attack succeeds, too many businesses still lack confidence in their ability to recover.

New research from Commvault's State of Data Resilience ANZ 2026 report found that 34 per cent of organisations that experienced a ransomware attack paid the ransom demand. Of those that paid, 36 per cent said the strategy ultimately failed because attackers either did not restore access to their data or returned with further demands.

For business leaders, those figures should prompt a rethink of how ransomware risk is managed.

The critical question is no longer simply whether an organisation can prevent an attack. It is whether the business can continue operating when one gets through.

Why businesses still pay

From the outside, paying a ransomware demand can appear difficult to justify. There is no guarantee criminals will provide functioning decryption tools, return stolen information or refrain from making further demands.

Inside a business experiencing a major outage, however, the calculation can look very different.

Executives may be confronting systems that are unavailable, customers unable to access services, employees unable to work and potentially significant financial losses accumulating by the hour.

Under those conditions, the ransom can begin to look less like a payment to criminals and more like a potential shortcut back to normal operations.

That is precisely where organisations become vulnerable.

If leadership does not know how long internal recovery will take—or whether critical data and systems can be recovered at all—the attacker effectively gains leverage over the organisation's business continuity strategy.

The decision about whether to pay is therefore often made long before the ransom note arrives. It is determined by how much preparation the organisation has undertaken beforehand.

The gap between business and technology

One of the most revealing findings in Commvault's research is the disconnect between understanding the business and understanding the technology that supports it.

Sixty-one per cent of organisations across Australia and New Zealand have defined the minimum business functions they need to continue operating during a cyber crisis. Yet only 43 per cent have done the same for their technology environments.

That difference matters.

A retailer might know that payments and order fulfilment are essential. A manufacturer may identify production and logistics. A financial institution might prioritise customer transactions.

But identifying a business function is only the beginning. Organisations also need to understand the applications, infrastructure, identities and data that allow that function to operate.

Without that visibility, recovery quickly becomes complicated.

Instead of restoring the systems that deliver the greatest business value first, technology teams can find themselves attempting to recover large environments simultaneously while executives wait for certainty about when operations will resume.

That is why recovery prioritisation needs to become a business decision rather than an IT decision.

Define the business you cannot operate without

An increasingly useful concept in resilience planning is the "Minimum Viable Company".

The principle is straightforward: organisations identify the minimum combination of people, processes, applications, systems and data required to keep the business functioning during a major disruption.

Rather than asking how quickly the organisation can recover everything, leaders ask what absolutely must be recovered first.

That distinction becomes increasingly important as enterprise technology environments expand.

Cloud adoption has distributed workloads across multiple platforms, while artificial intelligence is contributing to rapid growth in organisational data. Commvault's wider 2026 ANZ research found data estates are growing by around 30 per cent compared with 2025, largely as a result of AI deployment and adoption.

Attempting to recover an entire modern enterprise environment at once is therefore becoming increasingly unrealistic.

Businesses need priorities.

Those priorities should also be established at executive level, because deciding which services return first inevitably means deciding which customers, operations and revenue streams matter most during a crisis.

Recovery needs to be proven

Having a recovery strategy on paper is not the same as knowing it will work.

That distinction becomes crucial during ransomware incidents because attackers increasingly seek to compromise not only production environments but also the systems organisations depend upon for recovery.

Businesses therefore need confidence that critical data is protected, recovery copies are clean and essential applications can actually be restored within the timeframe expected by management.

The only meaningful way to develop that confidence is through regular testing.

A recovery exercise can reveal missing dependencies, unrealistic recovery targets and systems that do not restore as expected. Finding those weaknesses during a simulation is inconvenient. Discovering them while a ransomware attack is unfolding can be enormously expensive.

This is also where boards and executive teams have a role to play.

Cyber resilience metrics should increasingly tell leaders not merely how many threats were detected or vulnerabilities patched, but whether the organisation could continue delivering its most important services following a major compromise.

That moves the conversation from cybersecurity performance to business performance.

Resilience is becoming a competitive issue

As organisations become more dependent on digital infrastructure, the ability to recover from disruption will increasingly influence their ability to compete.

Customers have little interest in whether an outage was caused by ransomware, infrastructure failure or human error. They care whether the service they depend upon remains available.

The same is true for suppliers, business partners and investors.

Organisations that can demonstrate they understand their critical dependencies and have tested their ability to recover them are better positioned to navigate disruption with confidence.

Those that cannot may find themselves making some of their most consequential business decisions under extreme pressure.

Ransomware will continue evolving, and preventing attacks will remain essential. But no organisation can reasonably assume every attack will be stopped.

The more important objective is ensuring that when an attack succeeds, the business - not the attacker - still controls what happens next.