The thin line between saving a company and funding a crime

The report examines the opaque practice of ransomware negotiation, contrasting leading incident response firms’ policies (from refusing to negotiate or pay to negotiating but not handling payments), and detailing prevalent negotiation tactics such as delaying, limiting early financial discussion, and keeping a non-confrontational tone. It highlights escalations in attacker behavior (intimidation calls, re-extortion), ethical and legal risks around payments and sanctions, and financial conflicts introduced by contingency-based fee models. Experts argue for greater transparency, standardized oversight, vetted negotiators, auditable communications, and anonymized after-action reviews to better protect victims without empowering criminal enterprises.