Almost half of firms within the UAE selected to pay ransoms to cybercriminals in 2024, in response to Sophos’s sixth annual State of Ransomware report.
The cybersecurity agency’s vendor-agnostic survey of IT and cybersecurity leaders throughout 17 international locations reveals that 43 per cent of UAE organisations with encrypted information paid the ransom, with the median cost reaching $1.33 million.
The report, which surveyed 3,400 IT and cybersecurity leaders in organisations hit by ransomware over the earlier yr, reveals that 30 per cent of UAE firms that paid ransoms negotiated quantities decrease than the preliminary demand.
Most UAE corporations get well ransomware information
Globally, 71 per cent of firms that paid lowered quantities achieved this by negotiation, both independently or with third-party help.
“For a lot of organisations, the possibility of being compromised by ransomware actors is simply part of doing enterprise in 2025,” mentioned Chester Wisniewski, director of area CISO at Sophos. “The excellent news is that, because of this elevated consciousness, many firms are arming themselves with assets to restrict harm.”
Exploited vulnerabilities emerged as the first technical root explanation for ransomware attacks in the UAE, accounting for 42 per cent of incidents. Malicious emails initiated 23 per cent of assaults, while compromised credentials have been utilized in 18 per cent of circumstances.
The report highlights that 49 per cent of ransomware victims mentioned adversaries exploited safety gaps they have been unaware of, demonstrating organisations’ ongoing battle to determine and safe their assault floor.
Useful resource constraints affected 54 per cent of UAE organisations that fell sufferer to assaults, with one-third citing lack of awareness and 30 per cent reporting employees shortages.
The affect on information stays extreme within the UAE, with 55 per cent of assaults efficiently encrypting information, surpassing the worldwide common of fifty per cent. In 43 per cent of those circumstances, information was additionally stolen, considerably increased than the worldwide fee of 28 per cent.
Regardless of these challenges, 98 per cent of affected organisations recovered their information. Restoration strategies included utilizing backups (68 per cent of circumstances) and paying ransoms (43 per cent of circumstances).
Ransomware restoration prices under international common
Excluding ransom funds, the typical price for UAE organisations to get well from ransomware assaults reached $1.41 million, under the worldwide common of $1.53 million. These prices embody downtime, personnel time, system alternative, community restoration, and misplaced alternatives.
UAE organisations demonstrated swift restoration capabilities, with 63 per cent attaining full restoration inside one week, notably above the worldwide common of 53 per cent. Solely 15 per cent required between one and 6 months to get well, under the worldwide common of 18 per cent.
The assaults considerably affected cybersecurity personnel in organisations the place information was encrypted. The survey discovered that 40 per cent reported elevated strain from senior management, while 37 per cent skilled elevated workloads following assaults.
Stress ranges rose considerably, with 42 per cent reporting elevated nervousness about future assaults and 18 per cent experiencing crew member absences attributable to stress or psychological well being points.
While median international ransom calls for dropped by one-third between 2024 and 2025, median funds fell by 50 per cent, indicating firms’ rising success in minimising ransomware affect.
Ransom calls for diverse considerably based mostly on organisation dimension, with firms exceeding $1 billion in income dealing with median calls for of $5 million, while organisations with $250 million income or much less noticed median calls for under $350,000.
Wisniewski emphasised that ransomware will be prevented by addressing root causes: “exploited vulnerabilities, lack of visibility into the assault floor, and too few assets.” He famous rising adoption of Managed Detection and Response (MDR) companies for defence.
Sophos recommends a number of practices to defend towards ransomware:
- Eliminating frequent technical and operational root causes resembling exploited vulnerabilities
- Guaranteeing all endpoints have devoted anti-ransomware safety
- Sustaining examined incident response plans and common backup restoration practices
- Implementing round the clock monitoring and detection capabilities