Hackers Are Sophisticated & Impatient — That Can Be Good

Hackers are described as sophisticated, opportunistic and impatient, with major ransomware gangs operating like highly organised SaaS vendors that include affiliates, customer “support” and dashboards. The article notes that, at the time of its takedown in 2024, LockBit targeted more than 2,000 companies worldwide and had received over $120 million in ransom, illustrating the scale and profitability of these operations.

It argues that organisations can turn this urgency to their advantage by preparing a ransomware negotiation playbook, establishing relations with third‑party negotiators, and conducting regular tabletop exercises to practice responses before a breach occurs. To deny attackers easy access, it advises withholding sensitive information and using tactics such as the LAP test to structure counteroffers, with examples like a demand of $10 million met by a counteroffer of $300,000.

The piece also highlights the value of patience on the defender’s side, noting that delaying price talks and demanding proof-of-life data can push negotiations towards lower settlements, while stressing the need for ongoing preparation rather than mere knowledge. According to Verizon's 2025 "Data Breach Investigations Report," 88% of breaches involved stolen credentials and 54% of ransomware victims had domains exposed in stealer log marketplaces.