Ransomware negotiation tactics have turned into a business process

In this Help Net Security video, Dave Ross, Senior Director of the Intelligence Fusion Team at Intel 471 , explains what happens behind the scenes during ransomware negotiations.

Ross walks through the tactics groups use once an attack begins, from research on a victim’s revenue and insurance coverage to test decryptions that prove they hold a working key.

He describes how demands are often set at roughly 1% to 5% of annual revenue, why deadlines move depending on how a victim responds, and how some groups split work between researchers, negotiators, and staff who apply public pressure.

He also covers the criminal service economy supplying language skills, data review, and legal analysis, along with multi-extortion methods such as data theft, DDoS attacks, and with customers and journalists. He outlines the preparation that should happen before an incident , including who is authorized to speak and which stakeholders to involve.

Download: 2026 Credential Risk Report

Thomson Reuters reveals breach that exposed U.S. and Canadian court records

Your threat feed is someone else’s database: What ingesting malware intel at scale takes

When AI quietly breaks things, who pays?

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

Ransomware negotiation tactics have turned into a business process

September 2026 Patch Tuesday forecast: All we need is more time

OpenAI is putting $1 billion behind Daybreak for defenders working without enterprise budgets

Thomson Reuters reveals breach that exposed U.S. and Canadian court records

Your threat feed is someone else’s database: What ingesting malware intel at scale takes