A Quiet Number That Should Be Setting Off Alarms
Every year, Sophos publishes its State of Ransomware report, based on what it describes as an independent, vendor-agnostic survey of IT and cybersecurity leaders whose organizations were hit by ransomware. The 2025 edition, published in June 2025, covers 3,400 respondents in 17 countries from organizations with 100 to 5,000 employees. In December 2025 Sophos published a separate cut, The State of Ransomware in Enterprise 2025, covering the 1,733 respondents from enterprises with 1,000 to 5,000 employees. Sophos names each report for the year of the survey (January to March 2025), so many of the attacks it describes happened in 2024.
The headline findings are encouraging: data encryption rates are falling, recovery is getting faster, and fewer victims are paying the ransom.
But the enterprise report contains a number that ought to be on every CISO's whiteboard:
Among enterprises whose data was encrypted, the share that used backups to restore it dropped from 73% in 2024 to 53% in 2025. Sophos calls it a four-year low.
Read that again. In the year when defenders got better at stopping ransomware before encryption, the enterprises that did suffer encryption were measurably less likely to recover from their own backups.
This is not a minor footnote. We think it is the most strategically important finding in the Sophos data. The headline numbers tell one story; the recovery data tells another. This article walks through what we believe the data reveals about ransomware resilience, and why backup confidence has become the metric that matters most.
The Surface Narrative: Defense Is Winning
Let's start with the good news, because there is genuinely some.
Across all 3,400 respondents in the main 2025 report:
- Data encryption fell to 50% of attacks, down from 70% in 2024 and the lowest rate in the six years of the study.
- The average (mean) cost to recover, excluding any ransom, dropped from $2.73 million to $1.53 million.
- The median ransom payment fell by 50%, from $2 million in 2024 to $1 million in 2025.
- 53% of victims were fully recovered within a week, up from 35% in 2024.
- 49% of victims with encrypted data paid the ransom, down from 56% in 2024.
Among enterprises, according to the enterprise report:
- Data encryption fell to 49% of attacks, down from 66% in 2024.
- The share of attacks stopped before encryption more than doubled in two years, from 22% in 2023 to 47% in 2025.
Sophos reads the encryption drop as a sign that organizations "are more capable of stopping attacks before the encrypted payload is deployed", and the faster recovery as a possible sign of investment in "cyber incident preparation and recovery readiness". Read on their own, these numbers say the industry has turned a corner.
Then you reach the recovery data.
The Contradiction That Reveals Everything
Here is the data point that complicates the optimistic narrative.
Among enterprises whose data was encrypted, 53% used backups to restore it, down from 73% a year earlier. Over the same period, 48% paid the ransom to get data back, down from 55% (enterprise report). Both routes shrank. Close to a third (30%) of enterprises with encrypted data said they used other means, which Sophos suggests could include "restoration from shadow copies, utilizing endpoint protection rollback features or recovering data from unaffected systems".
In 2024, backups led ransom payment by 18 points (73% against 55%). In 2025 the lead was 5 points (53% against 48%). Fewer enterprises are paying, which is good news. But the recovery layer that was supposed to make paying unnecessary is carrying less of the load, not more.
Sophos's own summary is direct: "Collectively, these findings point to stronger resistance to demands together with weaknesses and lack of backup resilience."
Weaknesses and lack of backup resilience: that is the part we care about. Defenders are getting better at stopping attacks early. But when an attack does succeed and data is encrypted, the backups that should be the safety net are being used less often.
That is not a story about ransomware getting harder. It is a story about backup architecture getting exposed.
Why Are Backups Failing at the Moment of Truth?
The Sophos reports do not say why backup use fell. The survey records how data was recovered, not why backups were or were not used. The three patterns below are our interpretation, supported by Sophos data where it exists.
Pattern 1: Backups Are Being Compromised Alongside Production
Attackers go after backups deliberately. In Sophos's 2024 study of compromised backups, 94% of organizations hit by ransomware said the attackers attempted to compromise their backups, and 57% of those attempts succeeded. Organizations whose backups were compromised were almost twice as likely to pay the ransom (67% against 36%), and their median recovery cost was eight times higher ($3 million against $375,000).
Data theft adds to the pressure. In the enterprise report, 30% of enterprises that had data encrypted also had data stolen (15% of all enterprise victims). A clean restore does nothing about data that has already left the building.
If your backup system shares a domain, an identity provider, or a credential set with your production environment, it is not a separate recovery layer. It is the next target in the same kill chain.
Pattern 2: "Backup Success" Does Not Equal "Restore Success"
The enterprise data contains a direct signal. Of the 72 enterprises that paid more than the initial ransom demand, 42% gave this reason: "Our backups failed or were malfunctioning" (enterprise report). The group is small, but it is enterprise victims saying in plain words that their backups did not hold.
The human cost is also clear. Every enterprise that had data encrypted reported repercussions for its IT/cybersecurity team: 40% reported increased pressure from senior leaders, 39% increased anxiety or stress about future attacks, and in 27% of cases the team's leadership was replaced.
A job log that says "success" tells you the backup ran. It does not tell you the restore will work at the speed or completeness the business needs.
This is the failure mode the "0" in the 3-2-1-1-0 rule addresses. Veeam's security best practice guide defines it as "0 errors" in automatic recoverability verification of every backup with SureBackup. A completed job is not a verified restore, and verification only counts if it tests the recovery scenarios you would face in a real incident.
Pattern 3: The Organizational Layer Is the Weakest Link
For the first time in 2025, Sophos asked victims about the organizational factors that left them exposed. Across all 3,400 respondents in the main report:
- 40.2% cited a lack of expertise: not having the skills or knowledge to detect and stop the attack in time.
- 40.1% cited unknown security gaps: weaknesses in their defenses they were not aware of.
- 39.4% cited a lack of people or capacity.
- Respondents named 2.7 contributing factors on average.
The enterprise cut is almost identical: an unknown security gap (40%), a lack of people or capacity (39.2%) and a lack of expertise (38.9%) lead the list, with three factors cited on average.
Read plainly: security teams are short of people and skills, and have blind spots they cannot see. We would argue that backup infrastructure sits where all three weaknesses meet. When the people who run it also run incident response, patching and identity, it rarely gets architectural attention until an incident asks it to deliver.
What the Industry-Specific Reports Add
Sophos also published sector cuts of the 2025 survey.
In manufacturing and production (332 respondents), the encryption rate fell to 40%, the lowest in five years, and the median ransom payment was $1 million, down from $1.2 million. 47% reported increased anxiety or stress about future attacks in the IT/cybersecurity team. Backup use held steady at 58%.
In retail (361 respondents in 16 countries), the encryption rate fell to 48%, also a five-year low. An unknown security gap was the most common operational factor, named by 46% of victims. 58% of retailers with encrypted data paid the ransom, which Sophos calls "the second highest ransom payment rate in five years". The median ransom demand doubled from $1 million to $2 million, and backup use fell to 62%, the lowest in four years.
The sector picture is mixed: retail backup use fell, manufacturing held. What the sector reports share with the enterprise data is that prevention is improving faster than backup-based recovery. Encryption rates fell in both sectors, while backup use fell or stood still. That gap between prevention maturity and recovery maturity is, in our view, where ransom payments live.
What the Sophos Report Recommends (and Where We Would Add Weight)
The main and enterprise reports close with the same four recommendations:
- Prevention: eliminate the technical and operational root causes the report identifies.
- Protection: strong foundational security, with endpoints (including servers) well defended, including dedicated anti-ransomware protection that can stop and roll back malicious encryption.
- Detection and response: around-the-clock threat detection and response, through a managed detection and response (MDR) provider if you lack the resources or skills in house.
- Planning and preparation: an incident response plan you are well-versed in deploying, plus quality backups and regular practice restoring data from them.
All correct. Backups are there, in one sentence under planning and preparation. Given the enterprise backup numbers, we would give recovery more weight than that:
Recovery architecture itself must be modernized, not just defended.
A backup environment designed to recover from hardware failures and accidental deletions is not the same as one designed to recover from an adversary who is already inside the network and goes after the backups first. The first is a redundancy problem. The second is an architectural one. Practicing restores is necessary, but it does not help if the attacker can reach the backups you practiced with.
The Backup Confidence Gap: What to Measure Instead
If you take one operational change away from the 2025 Sophos data, let it be this: stop treating backup success rate as your recovery metric, and start measuring backup confidence.
Backup success rate is the metric your backup software gives you for free. It answers one question: did the job complete? On its own, it is not a recovery indicator. We think the gap between what the dashboard shows and what an incident delivers is part of what the 20-point drop in backup-based recovery reflects.
Backup confidence asks different questions:
- Can we restore tier-one systems from immutable storage within our stated RTO, today, under contested conditions?
- Do our recovery procedures work when production identity providers are compromised?
- Have we validated that our retention policies cannot be modified by any production-tier credential?
- Do we monitor backup-system telemetry for adversary behavior, not just job completion?
- When the IR team is asked "should we pay?", what is the technical basis for the answer?
These questions have answers. Many enterprises do not yet know theirs.
What We Take From the 2025 Sophos Data
Reading the reports in full, the story we see is this.
Organizations have gotten meaningfully better at stopping ransomware before it encrypts data. That is a real improvement, and it deserves recognition.
But the recovery layer, the promise that organizations would never have to pay because they could restore from clean backups, is carrying less of the load. In the enterprise data, the 20-point drop in backup-based recovery is the smoke. We think the architectural gap underneath is the fire.
For enterprises in regulated sectors, running complex hybrid estates, or simply unwilling to fund the next ransomware campaign, this is the conversation to have now. The question is not "do we have backups?" It is this: does our backup architecture survive a real adversary, and can we prove it before we need it?
How BackupSec Approaches the Confidence Gap
At BackupSec, we work from the premise that backup environments must be observable and tested under adversarial conditions, not just operational under normal ones. Three of our services map to the failures above:
- ZeroMON monitors Veeam Backup & Replication: job health, configuration drift with a Forensic & Audit trail of who changed what and when, a Security Analyzer checklist, reports, and a honeypot on the monitoring appliance. It shows immutability status as Veeam's own repository settings report it; it reads Veeam's configuration and does not verify object-level locks on the storage. Alerts go out by email and in-app notification. ZeroMON deploys on-premises as an OVA and connects with a read-only account, and nothing it collects is sent to BackupSec or any third party.
- ZeroTAM gives your team a dedicated backup-security advisor for architecture reviews, ransomware recovery planning, capacity planning and priority crisis support. It is an advisory service, not software, and it speaks directly to the lack-of-expertise and lack-of-capacity findings above.
- ZeroPEN is a threat-led penetration test of Veeam Backup & Replication, Veeam ONE and Enterprise Manager. It simulates a ransomware kill chain mapped to MITRE ATT&CK in eight stages: initial access, discovery and inventory, credential abuse, Veeam server compromise, repository access, backup neutralization, exfiltration simulation, and proof of encryption capability. It is non-destructive: ZeroPEN "never deletes real backups, performs real encryption, or stops production or backup services". The engagement also includes restore-integrity and immutability verification, and ends with an audit-ready report package and a retest for critical findings.
We do not replace your backup platform. We help you see and test the one you already run.
The 53% in the Sophos enterprise data is not destiny. In our view it reflects backup architectures built for a different threat.
Talk to BackupSec about your backup security →
This analysis draws on Sophos's State of Ransomware 2025 report, its State of Ransomware in Enterprise 2025 report and its 2025 sector reports. The interpretation is BackupSec's own. Sophos has since published The State of Ransomware 2026; this article covers the 2025 data. To discuss how these findings apply to your environment, get in touch with our team →