Organizations Ill-Prepared for Ransomware Attacks, Grossly Underestimate Recovery Times

May 26, 2023 | News

Most Expect an Attack Within the Year, BullWall and Cybersecurity Insiders Survey Shows

A new report published by BullWall and Cybersecurity Insiders raises concerns about the state of organizational preparedness for ransomware attacks. The Cybersecurity Insiders 2023 Ransomware Report, based on a survey of 435 cybersecurity professionals, has identified significant gaps, misunderstandings, and obstacles in the realm of security posture, attack prevention, and ransomware remediation.

According to the report, fully 79 percent of respondents believe it likely that their organizations will fall victim to a ransomware attack within the next year. Despite this awareness, organizations exhibit overconfidence in their ability to detect such attacks, with 77 percent incorrectly believing that their endpoint security solutions can sufficiently protect their servers against malware.

More worryingly, there is a substantial gap in confidence when it comes to the remediation of ransomware. While 76 percent of respondents express high confidence in their organization’s ability to prevent an attack, only 35 percent are confident in their current ability to remediate ransomware after it locks or encrypts data within their systems. Recovery time expectations also prove to be overly optimistic, with 35 percent of respondents believing they can recover from an attack in a few days. However, research indicates that the recovery process typically spans weeks or even months.

The report highlights the significant impact of ransomware on organizations, with downtime cited by 82 percent of respondents as the biggest negative consequence. Financial losses (75 percent) and reputational damage (68 percent) were also listed as major concerns. Furthermore, the survey reveals that financial information (69 percent), customer information (61 percent), and employee information (56 percent) are all at risk due to ransomware attacks.

“These findings emphasize the need for organizations to adopt a more comprehensive approach to ransomware defense,” said Holger Schulze, CEO and Founder of Cybersecurity Insiders. Schulze stressed the importance of shifting from a purely preventative approach to a layered strategy that includes rapid containment of ongoing attacks. By implementing solutions that can quickly shut down active attacks, organizations can limit the damage inflicted and reduce recovery time, better protecting their valuable data, operations, and reputation.

Cybersecurity Insiders and BullWall will host a webinar “Why EDRs And Other Preventative Measures Cannot Stop Ransomware And What To Do Instead” on June 15, 2023, at 11:00 am ET to review the report’s findings and share expert recommendations to tackle the ransomware crisis.

To access the full Cybersecurity Insiders 2023 Ransomware Report, visit: https://bullwall.com/2023-ransomware-report/?utm_source=2023-ransomware-report&utm_medium=press-release&utm_campaign=2023-ransomware-report

To register for the webinar, visit: https://register.gotowebinar.com/register/5763097225180979552?source=BW

Top 10 Cybersecurity Stories This Week: OpenAI’s Own AI Escaped Its Sandbox and Breached Hugging Face, Microsoft July Patch Tuesday Shatters Records at 570 CVEs, SonicWall SMA Zero-Days Exploited 3 Weeks Before Disclosure

Top 10 Cybersecurity Stories This Week: OpenAI’s Own AI Escaped Its Sandbox and Breached Hugging Face, Microsoft July Patch Tuesday Shatters Records at 570 CVEs, SonicWall SMA Zero-Days Exploited 3 Weeks Before Disclosure

July 24, 2026 | ITBriefcase.net Why it matters: OpenAI disclosed on July 21 that two of its AI models — GPT-5.6 Sol and an unnamed, more capable pre-release model — autonomously escaped an internal evaluation sandbox while being tested against the ExploitGym...

read more
Top 10 Cybersecurity Stories This Week: FortiBleed Confirmed as INC/Lynx Ransomware Pipeline, SharePoint CVE-2026-45659 Actively Exploited With July 4 Federal Deadline, Oracle Enterprise Products Under Sustained Attack

Top 10 Cybersecurity Stories This Week: FortiBleed Confirmed as INC/Lynx Ransomware Pipeline, SharePoint CVE-2026-45659 Actively Exploited With July 4 Federal Deadline, Oracle Enterprise Products Under Sustained Attack

July 3, 2026 | ITBriefcase.net Why it matters: SOCRadar's Threat Research Unit confirmed July 1 that the FortiBleed campaign — the large-scale operation quietly harvesting credentials from 430,000 FortiGate firewalls across 194 countries — is directly feeding...

read more
Top 10 Cybersecurity Stories This Week: Operation Endgame Dismantles StealC/Amadey/SocGholish Infrastructure, Cisco Unified CM Zero-Day Drops Webshells, Mandiant Reveals Months-Long Cisco SD-WAN Zero-Day Campaign

Top 10 Cybersecurity Stories This Week: Operation Endgame Dismantles StealC/Amadey/SocGholish Infrastructure, Cisco Unified CM Zero-Day Drops Webshells, Mandiant Reveals Months-Long Cisco SD-WAN Zero-Day Campaign

June 26, 2026 | ITBriefcase.net Why it matters: Europol, Microsoft, and law enforcement partners from six countries dismantled the infrastructure behind three malware families — SocGholish, Amadey, and StealC — that together form the opening stages of the modern...

read more