Proofpoint MSP 2027 Ransomware Report Reveals Confidence Gap Despite Widespread Ransomware Protection Measures

• Ransomware incidence is falling: around 18% of respondents, down from 24% last year
• Ransomware prevention is widespread: 91% protect their backups, while 84% have a disaster recovery plan
• Phishing remains the most common point of entry: 52% of those affected by ransomware cite email or phishing as the attack vector
• Security awareness is on the rise: 84% offer training, up 10 percentage points from last year’s report

SUNNYVALE, Calif., Oct. 28, 2026 (GLOBE NEWSWIRE) -- Proofpoint, Inc., a global leader in human and agent cybersecurity, today launched its 2027 Ransomware Report from its Proofpoint MSP Platform business unit dedicated to serving managed service providers (MSPs) and small and mid-sized businesses. The data revealed that organizations are better prepared for ransomware attacks than ever before, but confidence in existing protection measures remains limited.

For the 2027 report, Proofpoint MSP Platform surveyed 400 global IT and cybersecurity experts on their experiences with ransomware and their organizations' protection and recovery measures. Despite the widespread implementation of preventative measures, almost half (45%) of those surveyed aren’t confident in the effectiveness of their organization’s own ransomware protection strategy.

Ransomware incidence falls again to around 18%

At the same time, the proportion of organizations reporting a ransomware attack has fallen to around 18%, down from 24% in last year’s report and broadly in line with the previously recorded level of 18.6%.

Key ransomware protection measures are now firmly established across many organizations, with 84% having a disaster recovery plan, up from 82% in last year’s report, and 91% protecting backup storage against ransomware.

Phishing remains the primary vector of entry

Attack vector responses show that email or phishing remains the primary vector of entry. Among respondents whose organizations have experienced a ransomware attack, 52% cite email or phishing as the attack vector, up from 46% in the previous report. Compromised endpoints follow in second place at 27%, virtually unchanged; 7% cite exploited vulnerabilities.

The prevalence of phishing highlights the importance of employee awareness in ransomware defense. Compromised endpoints rank second at 27%, showing that protection also needs to extend beyond the email inbox.

Fewer ransomware victims pay the ransom

Among those surveyed whose organizations have already experienced a ransomware attack, around 3% state that a ransom was paid to recover their data. This low proportion underlines the importance of reliable recovery options. Protected backups and effective recovery processes can help organizations access intact data and resume operations following a successful attack.

“Companies have noticeably stepped up their ransomware defences: secure backups, disaster recovery and security awareness training are now part of the security foundation in many organizations, which is an important step,” says Daniel Hofmann, GM & EVP of Proofpoint MSP Platform. “At the same time, our day-to-day work reveals how quickly attackers are evolving their methods. They use AI to make their attempts at deception more convincing, combine email with other communication tools in multi-channel attacks, or employ new obfuscation techniques to circumvent security mechanisms. For organizations, this means that achieving a certain level of security once is not enough. Security awareness, technical safeguards and security processes must keep pace with new and evolving attack methods.”

Security awareness training is on the rise

Companies are also stepping up their precautions where the human factor is concerned: 84% of respondents state their company offers security awareness training – up 10 percentage points from 74% in the previous report – and representing one of the largest shifts recorded in this year’s survey.

This trend is particularly relevant because phishing remains the most frequently cited attack vector for ransomware. Companies are increasingly focusing on preparing their staff for cyber threats and strengthening their ability to detect and respond to them.

AI raises the bar for ransomware defence

Deception tactics that staff need to be prepared for are evolving. This is particularly evident when looking at generative AI: 84% of respondents state that GenAI has heightened their organization’s concerns about cyberattacks and ransomware, while only 9% believe their staff would be able to reliably recognise an AI-generated phishing or identity spoofing attempt.

The results reveal a significant gap between awareness of AI-related risks and confidence in employees’ ability to recognise such deception attempts.

Ransomware protection must keep pace with attacks

The Ransomware Report 2027 paints a nuanced picture overall: the incidence of attacks has fallen compared with the previous report, and basic protective measures are widely in place. Phishing and compromised endpoints remain relevant attack vectors, while generative AI poses new challenges for the detection of deception attempts.

Email security, employee awareness, identity and endpoint protection, as well as backup and recovery, must work together. These measures can help organizations prevent and detect attacks early, respond quickly when incidents occur and restore operations reliably.

About the study

For the Ransomware Report 2027, Proofpoint MSP Platform surveyed 400 IT and cybersecurity experts on their experiences with ransomware, as well as their organizations’ protection and recovery measures. The study is Proofpoint MSP Platform’s sixth annual ransomware survey and took place in July and August 2026.

Further information on the Ransomware Report 2027 can be found here.

About Proofpoint, Inc.  
Proofpoint, Inc. is a global leader in human and agent cybersecurity, securing how people, data, and AI agents connect across email, cloud, and collaboration tools. Proofpoint is a trusted partner to over 80 of the Fortune 100, over 14,000 large enterprises, and millions of smaller organizations in stopping threats, preventing data loss, and building resilience across people and AI workflows. Proofpoint’s collaboration, data and AI security platform helps organizations of all sizes protect their people, defend their data, and adopt AI securely and confidently. Learn more at www.proofpoint.com.  
  
Connect with Proofpoint on LinkedIn 
   
Proofpoint is a registered trademark or trade name of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.  

Connect with Proofpoint MSP Platform business unit: LinkedIn.

Media inquiries
Please contact us at press@hornetsecurity.com