Hornetsecurity by Proofpoint Ransomware Report 2027 reveals nearly half of companies don't trust their own defences

• Ransomware incidence is falling: around 18% of respondents, down from 24% last year
• Ransomware prevention is widespread: 91% protect their backups, while 84% have a disaster recovery plan
• Phishing remains the most common point of entry: 52% of those affected by ransomware cite email or phishing as the attack vector
• Security awareness is on the rise: 84% offer training, up 10 percentage points from last year's report

LONDON, Oct. 27, 2026 /PRNewswire/ -- Leading global cybersecurity company Hornetsecurity by Proofpoint has launched its Ransomware Report 2027, revealing that organisations are better prepared for ransomware attacks than ever before, but confidence in existing protection measures remains limited.

Despite the widespread implementation of preventative measures, almost half (45%) of those surveyed aren't confident in the effectiveness of their organisation's own ransomware protection strategy.

Ransomware incidence falls again to around 18%

At the same time, the proportion of organisations reporting a ransomware attack has fallen to around 18%, down from 24% in last year's report and broadly in line with the previously recorded level of 18.6%.

Key ransomware protection measures are now firmly established across many organisations, with 84% having a disaster recovery plan, up from 82% in last year's report, and 91% protecting backup storage against ransomware.

Phishing remains the primary vector of entry

Attack vector responses show that email or phishing remains the primary vector of entry. Among respondents whose organisations have experienced a ransomware attack, 52% cite email or phishing as the attack vector, up from 46% in the previous report. Compromised endpoints follow in second place at 27%, virtually unchanged; 7% cite exploited vulnerabilities.

The prevalence of phishing highlights the importance of employee awareness in ransomware defence. Compromised endpoints rank second at 27%, showing that protection also needs to extend beyond the email inbox.

Fewer ransomware victims pay the ransom

Among those surveyed whose organisations have already experienced a ransomware attack, around 3% state that a ransom was paid to recover their data. This low proportion underlines the importance of reliable recovery options. Protected backups and effective recovery processes can help organisations access intact data and resume operations following a successful attack.

Daniel Hofmann, CEO of Hornetsecurity by Proofpoint: "Companies have noticeably stepped up their ransomware defences: secure backups, disaster recovery and security awareness training are now part of the security foundation in many organisations, which is an important step.

"At the same time, our day-to-day work reveals how quickly attackers are evolving their methods. They use AI to make their attempts at deception more convincing, combine email with other communication tools in multi-channel attacks, or employ new obfuscation techniques to circumvent security mechanisms.

"For organisations, this means that achieving a certain level of security once is not enough. Security awareness, technical safeguards and security processes must keep pace with new and evolving attack methods."

Security awareness training is on the rise

Companies are also stepping up their precautions where the human factor is concerned: 84% of respondents state their company offers security awareness training – up 10 percentage points from 74% in the previous report – and representing one of the largest shifts recorded in this year's survey.

This trend is particularly relevant because phishing remains the most frequently cited attack vector for ransomware. Companies are increasingly focusing on preparing their staff for cyber threats and strengthening their ability to detect and respond to them.

AI raises the bar for ransomware defence

Deception tactics that staff need to be prepared for are evolving. This is particularly evident when looking at generative AI: 84% of respondents state that GenAI has heightened their organisation's concerns about cyberattacks and ransomware, while only 9% believe their staff would be able to reliably recognise an AI-generated phishing or identity spoofing attempt.

The results reveal a significant gap between awareness of AI-related risks and confidence in employees' ability to recognise such deception attempts.

Ransomware protection must keep pace with attacks

The Ransomware Report 2027 paints a nuanced picture overall: the incidence of attacks has fallen compared with the previous report, and basic protective measures are widely in place. Phishing and compromised endpoints remain relevant attack vectors, while generative AI poses new challenges for the detection of deception attempts.

Email security, employee awareness, identity and endpoint protection, as well as backup and recovery, must work together. These measures can help organisations prevent and detect attacks early, respond quickly when incidents occur and restore operations reliably.

About the study

For the Ransomware Report 2027, Hornetsecurity by Proofpoint surveyed 400 IT and cybersecurity experts on their experiences with ransomware, as well as their organisations' protection and recovery measures. The study is Hornetsecurity's sixth annual ransomware survey and took place in July and August 2026.

Further information on the Ransomware Report 2027 can be found here.

About Hornetsecurity by Proofpoint

Hornetsecurity by Proofpoint is Proofpoint's business unit leveraging the Hornetsecurity product suite dedicated to managed service providers (MSPs) and small to mid-sized business (SMBs), providing next-generation cloud-based security, compliance, backup, and security awareness solutions that help companies and organisations of all sizes around the world. Its flagship product, 365 Total Protection, is the most comprehensive cloud security solution for Microsoft 365 on the market. Driven by innovation and cybersecurity excellence, Hornetsecurity is building a safer digital future and sustainable security cultures with its award-winning portfolio. Hornetsecurity operates in more than 120 countries through its international distribution network of 12,000+ channel partners and MSPs. Its premium services are used by more than 125,000 customers. For more information, visit  https://www.hornetsecurity.com/en/.

Media enquiries
Please contact us at press@hornetsecurity.com