Nearly 45% of organizations lack confidence in their ransomware defenses despite increased adoption of backup protection, disaster recovery planning, and security awareness training, according to a new report from Proofpoint.
Ransomware attacks decline as defenses improve
The 2027 Ransomware Report from Proofpoint’s MSP Platform business unit, which serves managed service providers (MSPs) and SMBs, found that while organizations are better prepared for ransomware attacks than ever before, there remains a gap in confidence in their protection measures.
The report surveyed 400 global IT and cybersecurity experts and included key findings such as:
- Ransomware incidence has fallen from 24% to 18% among respondents.
- Ransomware prevention is widespread, with 91% protecting their backups and 84% having a disaster recovery plan.
- 52% of respondents affected by ransomware cite email or phishing as the attack vector.
- Security awareness has increased, with 84% offering training, up 10% from the year prior.
Few ransomware victims report paying attackers
Of those that have experienced an attack, only 3% say that a ransom was paid to recover their data.
“Companies have noticeably stepped up their ransomware defenses: secure backups, disaster recovery, and security awareness training are now part of the security foundation in many organizations, which is an important step,” says Daniel Hofmann, GM & EVP of Proofpoint MSP Platform.
Protected backups and effective recovery processes are essential for organizations to access their data intact and resume operations after a successful ransomware attack.
“For organizations, this means that achieving a certain level of security once is not enough. Security awareness, technical safeguards, and security processes must keep pace with new and evolving attack methods,” Hofmann added.
AI-powered phishing raises new security concerns
According to the report, 84% of respondents say that generative AI has heightened their organization’s concerns about cyberattacks and ransomware.
Further, only 9% believe their staff would reliably recognize an AI-generated phishing or identity-spoofing attempt.
“Our day-to-day work reveals how quickly attackers are evolving their methods,” said Hofmann. “They use AI to make their attempts at deception more convincing, combine email with other communication tools in multi-channel attacks, or employ new obfuscation techniques to circumvent security mechanisms.”
What the findings mean for MSPs
For MSPs and other channel partners, the findings highlight an opportunity to help customers move beyond implementing basic security measures toward validating their effectiveness.
As AI-driven phishing and other attack methods evolve, partners can differentiate their services through ongoing security assessments, employee training, and tested backup and recovery processes that help customers build greater confidence in their ransomware readiness.
WATCH MORE: Optiv executives detail how AI has changed the company’s approach to security services.