Information Risk Insights Study: Ransomware Edition, 2024

The IRIS Ransomware Edition analyzes more than 14,000 ransomware events to put numbers on how often ransomware hits organizations and what it costs them. Ransomware caused 32% of publicly reported cyber incidents from 2019 to 2023 but 38% of reported losses. It’s the first IRIS to focus on a single incident pattern.

The data supports the view that ransomware is a top cyber risk, but the picture by firm size is more nuanced than the headlines suggest. Under the report’s upper-bound model, the annual chance of at least one ransomware event is fairly similar across revenue tiers, which the authors attribute to gangs tailoring demands to what each victim can pay. The largest enterprises are far more likely to suffer several events in a year, yet ransomware makes up a much bigger share of incidents and losses for small and midsize firms. Sector matters even more, and in a few industries ransomware accounts for most reported cyber losses. The report also cautions that ransomware’s recent share is probably inflated somewhat, since these events get disclosed faster than quieter intrusions.

The full report publishes frequency model parameters by revenue tier for anyone building their own models, a ransomware loss exceedance curve, and loss distributions by year, sector and size. It also estimates total losses and ranks the most common strains and MITRE ATT&CK techniques.

Key Findings

32% of Incidents, 38% of Losses: Ransomware accounted for 32% of publicly reported cyber incidents and 38% of reported losses from 2019 through 2023.
From Under 1% to 52%: Ransomware went from under 1% of reported incidents in 2015 to an average of 52% of monthly reported events in 2023.
10% Annual Chance: Under the upper-bound model, any given organization has about a 10% chance of at least one ransomware incident in the next 12 months.
$1.4M Typical Loss: The typical ransomware event costs $1.4M, about 12 times other incident types, and the 95th percentile reaches about $50M.
More Than 5x Growth in Typical Loss: The typical ransomware loss rose from $686K in 2019 to $3.7M in 2023.
Bigger Share for Smaller Firms: Ransomware makes up roughly 30% to 40% of incidents at firms under $100M in revenue, versus under 10% at $100B+ enterprises.
80% of Losses in Three Sectors: Ransomware accounts for about 80% of reported cyber losses in the Transportation, Education and Manufacturing sectors.

Cover of Information Risk Insights Study: Ransomware Edition, 2024

Independent analysis by Cyentia Institute, with support from CISA, of 14,000+ ransomware incidents from 2019 through 2023 in Advisen’s Cyber Loss Data, plus Fortinet, Ransomwatch and Tidal Cyber data.

Key Risk Insight

Ransomware is a top cyber risk for organizations of every size, but it takes a larger share of the losses at small and midsize firms and in sectors such as manufacturing and education. Ransomware risk estimates should start from a baseline matched to the organization’s size and sector.

Cite this report: Cyentia Institute (2024). Information Risk Insights Study: Ransomware Edition, 2024. https://www.cyentia.com/publication/iris-ransomware/

Download

Ransomware ranks first among incident patterns for financial impact, with over a third (37.6%) of all reported cyber losses from 2019 to 2023, while making up 32% of incidents.
Figure 3: Monthly percentage of all security incidents categorized as ransomware. Ransomware went from under 1% of reported incidents in 2015 to about half of monthly reported events in 2023.
Figure 8: Upper and lower bound model for annual ransomware event frequency. Under the upper bound, any given organization has about a 10% chance of at least one ransomware incident in the next 12 months.
Figure 10: Distribution of reported losses from ransomware incidents (all-time). The typical ransomware event costs about 12 times as much as other incident types.
Figure 11: Annual distribution of reported losses from ransomware events. The typical ransomware loss grew more than 5x between 2019 and 2023, and the 25th percentile loss in 2023 matches 2019’s typical loss.
Ransomware disproportionately affects smaller businesses (Figure 6). It accounts for 30% to 40% of incidents at firms under $100M in revenue, versus under 10% at $100B+ enterprises.
In Transportation, Education and Manufacturing, about 80% of known security incident losses come from ransomware (Figure 14). For Financial and Professional firms, ransomware is a much smaller part of reported losses.
Projected total cost of ransomware events based on known losses (Figure 18). Most ransomware events have no disclosed loss, so recorded losses ($2.44B) are a small fraction of the estimated total once known losses are applied to the rest.
Monthly ransomware detections per organization from Fortinet sensors, 2023 (Figure 9). These are blocked attempts, not incidents; organizations saw dozens to well over 100 attempts a month, which is why detection counts look so much higher than incident rates.

Get exclusive content, sector-specific updates, and expert commentary

Testimonials

“Cyentia delves into cyber risk, helping companies assess the frequency and severity they may face by providing industry data, averages, highs/lows and much more. This is crucial for any risk leader starting on a risk quantification journey. The Cyentia report has also become incredibly valuable for the Cyber Insurance industry.”
Isabelle Dumont, Tech B2B Leader
“One of the few reports I read cover to cover. IRIS 2025 from the Cyentia Institute team is, once again, a standout contribution. I’ve always appreciated their commitment to letting the data speak for itself. No hype, no sensationalism—just a clear-eyed attempt to map the cyber loss landscape using what’s actually observable.”
James Hanbury, Global Lead Director, Cyber Risk Insights at KPMG
“The latest Cyentia Institute IRIS 2025 report is out now! It’s a goldmine of data for quantitative risk work. Evidence-based incident probabilities, empirical loss distributions, attack pattern intelligence—this is what mature risk management looks like. Cyentia’s research gives us the statistical foundation our quantitative models need.”
Tony Martin-Vegue, Technology Risk Management at Netflix
“Just finished the Cyentia Institute’s IRIS and again I find myself in awe at the elite level of objective risk insight this report continuously provides. Beginning with base rate information before taking a plunge into the unique details of our individual case improves the quality of our risk assessment outcomes in multiple ways.”
Zach Cossairt, Decision Support at Equinix

Need an IRIS Focused on Your Organization?

That’s exactly what our Retina risk intelligence service provides. You get a report on key cyber risk factors for your peer group, along with monthly data and analysis to monitor prevailing trends.

Learn More