We Know You Can Pay a Million Review: Ransomware Economics, Negotiation, and the Business Model of Cybercrime

Books / Cybersecurity & Ransomware Economics

Ransomware is not merely malicious code. It is a market with pricing, labour, intermediaries, reputation, payments and enforcement. This review tests Anja Shortland’s economic lens against FBI, CISA, FinCEN and blockchain evidence.

Anja Shortland approaches ransomware with the instincts of a political economist rather than a malware analyst. That is the book’s advantage. The attacker who encrypts a network is only one participant in a wider market that includes initial-access brokers, infrastructure providers, negotiators, insurers, cryptocurrency services, affiliates, leak sites and victims with different willingness to pay. Once ransomware is viewed as an industry rather than a technical event, its persistence becomes easier to understand.

Current data support that framing. The FBI recorded more than 3,600 ransomware complaints in 2025 while warning that reported losses understate business disruption. Chainalysis estimates attackers received roughly $820 million in on-chain payments in 2025 even as claimed attacks rose. FinCEN found more than $2.1 billion in ransomware payments in Bank Secrecy Act data covering 2022 through 2024. Shortland’s core insight is therefore not rhetorical: an ecosystem this large develops prices, specialisation, reputation and counterparty rules just like legal markets do.

The ransom demand is a pricing decision, not a random threat

Shortland explains why attackers spend time learning about a victim’s revenue, cash, insurance and operational pressure before naming a price. In interviews she has described demands as deliberately set on the painful side of affordable. That is economically rational: a demand that exceeds the victim’s capacity produces no payment, while a demand set too low leaves money on the table.

The same logic explains why ransomware scales poorly as pure automation. Pricing requires information about business interruption, backup quality, regulatory exposure and the value of stolen data. Criminals therefore combine automated access with human negotiation, much like enterprise sales teams qualify prospects before proposing contract value.

The victim’s willingness to pay is dynamic. Every hour of downtime, every leaked file and every failed recovery test changes the bargaining range. Attackers exploit that clock, but defenders can alter it before an incident by reducing restoration time and clarifying decision authority.

Executives should treat recovery capability as bargaining power. Offline backups, tested restoration, segmented networks, crisis communications and pre-agreed legal authority do more than improve security; they reduce the economic leverage that makes a high ransom credible.

Ransomware has a supply chain

Chainalysis describes an ecosystem in which initial-access brokers, hosting providers and other specialists support ransomware operators. The 2026 report notes that on-chain flows to access brokers are tiny compared with ransomware payments, which illustrates the leverage available to a participant who can reliably sell entry into corporate networks.

Specialisation lowers the skill threshold for attackers. An affiliate no longer needs to invent malware, discover every vulnerability, host infrastructure and launder proceeds. Markets let each participant focus on one layer, increasing throughput and resilience even when individual groups are arrested or sanctioned.

This also explains why taking down one famous gang does not end the problem. People, credentials, malware families and infrastructure can recombine under new brands. Enforcement that targets shared enablement layers may have more systemic impact than publicity around a single takedown.

Defenders should mirror the adversary’s supply-chain model. Map external attack surface, identity providers, remote access, third-party vendors and privileged credentials as connected markets for access. The unit of defence is not only the endpoint; it is the path by which access can be acquired and monetised.

Reputation exists even in illegal markets

Extortion depends on a paradox: victims pay only if they believe criminals will do what they say. If attackers routinely keep leaking data after payment or fail to provide decryption keys, their threats become less monetisable. Shortland’s previous work on kidnapping economics makes this mechanism especially clear—repeat criminal markets can create reputational incentives without lawful contracts.

That does not make the market safe or predictable. Criminal groups can lie, affiliates can defect, and stolen data can remain valuable after payment. Reputation merely creates a probabilistic expectation that supports transactions. A victim should never confuse an attacker’s business incentive with a legal guarantee.

Law enforcement can exploit this fragility. Actions that undermine trust in decryptors, payment channels, infrastructure or group reliability raise transaction costs. If victims believe payment is less likely to restore operations, expected criminal revenue falls.

For boards, the implication is uncomfortable but practical: a ransomware decision is made under radical counterparty risk. Incident plans should include criteria for legal, sanctions, operational and reputational assessment rather than delegating the question to a negotiator at the moment of maximum pressure.

The visible ransom is smaller than the economic loss

FBI loss figures come with an explicit warning that they normally exclude lost business, downtime, wages, files, equipment and many remediation services. That makes ransomware statistics easy to misread. The transfer to the attacker is only one line in the incident’s total cost.

Shortland’s economic framing is strongest here. Attackers create value for themselves by destroying far more value for the victim. The ratio can resemble wrecking an expensive asset to steal a much smaller amount. This asymmetry is why even modest ransom revenue can justify significant public investment in prevention and disruption.

Companies often budget cybersecurity against expected direct losses and underweight operational concentration. If one identity system, ERP, plant network or cloud tenant can halt the organisation, the relevant exposure is the cash burn and customer damage during recovery.

A better board metric is maximum tolerable outage by critical process. Convert hours of downtime into revenue, penalties, safety risk, customer churn and manual-work capacity. Security spending can then be compared with the actual economic surface rather than the attacker’s invoice.

Insurance changes incentives on both sides

Cyber insurance can finance response expertise and transfer part of the loss, but it also becomes information in the bargaining environment. Attackers have historically searched victim systems for insurance documents and financial data because coverage can reveal capacity to pay. Shortland’s title captures the logic: the adversary may know more about affordability than the victim expects.

Insurers have responded by tightening controls, exclusions and underwriting requirements. That can improve security because firms seeking coverage must demonstrate MFA, backups and governance. Insurance therefore has two effects at once: it can increase payment capacity in an incident while raising prevention standards before one.

The policy debate becomes simplistic when it asks whether insurance ‘causes’ ransomware. Attackers existed before mature insurance markets, and insured organisations can still refuse payment. The more useful question is whether policy terms price risk accurately and reward controls that lower expected extortion value.

Companies should treat the application process as an external audit. If an insurer asks about a control repeatedly, examine why. Coverage is valuable, but the objective is not to become a better payer; it is to become a harder and less profitable target.

Cryptocurrency is infrastructure, not the root cause

Ransomware’s modern scale was helped by payment rails that allow large cross-border transfers without conventional banking friction. Blockchain analytics also create an unusual counterforce: many cryptocurrency transfers are public and can be traced, clustered and linked to services. Chainalysis and government agencies increasingly use that transparency to identify payment flows and infrastructure.

The result is an arms race rather than perfect anonymity. Criminals use mixers, cross-chain movement, nested services and laundering networks; investigators use attribution, sanctions and exchange cooperation. Payment infrastructure matters, but access to networks and the ability to impose operational pain remain the deeper source of extortion power.

Banning one payment mechanism would not eliminate coercion if victims remain vulnerable and attackers can find substitutes. Conversely, treating crypto tracing as irrelevant ignores a meaningful enforcement tool. Shortland’s market perspective encourages analysis of the entire transaction chain rather than one ideological target.

For incident teams, payment preparation must include sanctions screening, wallet intelligence and specialist counsel. A rushed transfer can create legal exposure in addition to cyber loss. Those relationships should be established before an event, not sourced while systems are encrypted.

The best negotiation happens before the attacker arrives

CISA’s StopRansomware guidance emphasises preparation, segmentation, credential security, backups, incident response and out-of-band communications. These controls seem technical, but in Shortland’s framework they are negotiation variables because they determine how desperate the victim becomes.

A company that can restore critical systems in hours has a different reservation price from one that needs weeks. A company that knows exactly which data left the network can make a more informed decision than one facing uncertainty. Preparedness reduces the attacker’s information advantage.

Tabletop exercises are therefore not theatre. They expose who can shut down systems, who contacts law enforcement, who talks to customers, how legal privilege works, and whether the board has defined payment principles. Delay caused by internal confusion is a subsidy to the extortionist.

Operators should simulate the business decision, not just the security response. Give executives incomplete information, time pressure, regulatory constraints and a changing ransom demand. The goal is to rehearse trade-offs while adrenaline is absent.

Disruption must target economics, not only malware

Law enforcement frequently announces seizures, arrests and decryption tools, yet the market regenerates. Chainalysis notes a shift toward targeting infrastructure and enabling services, while FinCEN uses financial reporting to identify payment patterns. These approaches attack the economics of the ecosystem rather than treating every binary as an isolated technical object.

A resilient criminal market survives individual failures if replacement is cheap. Raising the cost of access, hosting, laundering and recruitment changes that equation. The objective is not a cinematic final victory; it is to lower expected profit, increase uncertainty and reduce the number of successful transactions.

Private firms participate in that strategy when they patch exploited vulnerabilities, report incidents, share indicators and refuse preventable access paths. One company’s disclosure can reduce another’s probability of compromise.

Boards should view reporting and cooperation as part of risk reduction rather than reputational embarrassment. Silence preserves attacker information advantages. A healthier market for defence depends on making incident knowledge travel faster than criminal playbooks.

Verdict: the book turns ransomware from a technical mystery into a managerial problem

We Know You Can Pay a Million is valuable because it gives executives a language for ransomware that connects technology to incentives. Once you see pricing, bargaining, supply chains, reputation and liquidity, several security recommendations become easier to justify in economic terms.

The book should not replace technical guidance. CISA, NIST, incident-response teams and security engineers provide the control detail that a political-economy narrative cannot. Shortland’s contribution is explaining why those controls change the adversary’s business model.

Its most sobering implication is that ransomware persists because enough transactions remain profitable. Heroic response after encryption is less powerful than systematically reducing access, downtime and payment certainty across many organisations.

For founders, CFOs and boards, that is the actionable lesson: cyber resilience is not an IT expense sitting outside strategy. It determines your bargaining position in a market where the counterparty has designed the crisis to make rational decision-making difficult.

What the 2025–26 data changes about the ransomware market

The newest ransomware data reinforces Shortland’s market framing while adding an important complication. FBI complaint statistics record thousands of ransomware reports, but the reported direct-loss figure captures only a fraction of the true economic damage because downtime, remediation, lost sales, legal work and recovery costs are often excluded. At the same time, Chainalysis estimates hundreds of millions of dollars in on-chain ransomware payments during 2025, while FinCEN’s analysis of Bank Secrecy Act data documents more than two billion dollars in ransomware-related payments over 2022–2024. The datasets use different scopes and cannot be added together. Read together, however, they show why a single headline number is a poor way to understand the market.

The strategic change is fragmentation. More actors can enter because the ecosystem separates access, malware, negotiation, laundering and infrastructure. That division of labor lowers some barriers to entry even as sanctions, seizures and better defense raise others. A large brand name may disappear while affiliates, credentials and tooling move elsewhere. This is why counting ransomware “groups” can create false confidence. The business model is modular. Disruption can destroy a node without destroying the market. Shortland’s emphasis on bargaining and reputational mechanisms remains useful because attackers need victims to believe both threats and promises. If a decryptor never works or payment always leads to renewed extortion, the market’s willingness to pay changes.

For defenders, the data also argues against optimizing only for whether a ransom is paid. The economically relevant variable is total incident cost. A company that refuses payment but remains offline for weeks may still suffer a catastrophic outcome. Another that restores quickly from tested backups may reduce the attacker’s leverage before negotiation begins. The board-level objective should therefore be resilience: reduce the probability of compromise, contain blast radius, preserve recovery options, rehearse decision rights and understand legal constraints. Payment is one branch of the incident tree, not the strategy.

A board-level ransomware decision checklist

A board should know the answers to several questions before an extortion note appears. Which systems are genuinely critical to revenue, safety or regulatory obligations? Are backups immutable, segmented and restoration-tested rather than merely present? Who has authority to shut networks down, contact law enforcement, engage negotiators or approve extraordinary payments? Which insurers, outside counsel and incident-response firms are pre-retained? What sanctions-screening process applies if a payment is considered? How quickly can the company determine whether the attacker has merely encrypted data or also exfiltrated it? Each unanswered question increases the value of time to the attacker.

The negotiation question deserves particular discipline. A ransom demand is not a normal invoice. The attacker is trying to infer willingness and ability to pay from firm size, insurance, public filings, stolen documents and the urgency of operational disruption. Revealing information carelessly can move the price. Conversely, treating every demand as meaningless bravado can be equally costly. Professional negotiators matter because they understand the signals, timelines and reputational history of threat actors. Shortland is especially useful here: she treats negotiation as an institution that emerges inside an illegal market, not as evidence that criminals have become trustworthy.

After an incident, management should measure more than the amount transferred. Track time to detection, time to containment, restoration speed by critical system, data-loss scope, customer churn, legal exposure, insurance recovery and the control failures that enabled access. Then change incentives. If security teams are praised for avoiding visible incidents while vulnerabilities accumulate, the organization will underinvest in resilience. If business units can bypass controls without bearing expected loss, cyber risk remains centralized only on paper. The best ransomware strategy makes the attacker’s expected economics worse before a negotiation starts.

Why cyber insurance changes the bargaining game without solving it

Cyber insurance alters ransomware economics because it changes both victim resilience and attacker expectations. Insurance can fund incident-response specialists, legal counsel, forensics and business interruption, which can materially improve recovery. But coverage can also become part of the information environment around a negotiation. If attackers obtain policy documents or infer a firm’s coverage limits, they gain another signal about willingness and capacity to pay. This does not mean insurance causes ransomware. It means a risk-transfer instrument becomes one variable inside a strategic bargaining system. The sensible response is not to abandon insurance but to treat policy design, security controls and confidentiality as one integrated program.

The deeper lesson is that financial transfer cannot replace operational resilience. An insurer can reimburse some losses; it cannot instantly restore a production line, reconstruct corrupted data or recover customer trust. Coverage conditions are also increasingly tied to controls such as multifactor authentication, endpoint monitoring and backup practices. Boards should therefore evaluate insurance in the same way they evaluate any hedge: what exposure remains after the contract, under what exclusions, with what counterparty and claims-process risk? Shortland’s market perspective helps because it prevents a narrow “security department” view. Ransomware sits at the intersection of technology, finance, law, negotiation and organizational preparedness. A company that manages only one of those dimensions leaves the attacker a route to leverage.

The economic objective is to destroy attacker leverage

Every defensive investment should ultimately reduce one of the attacker’s sources of bargaining power. Better identity controls reduce entry probability. Network segmentation reduces the number of systems an intruder can hold hostage at once. Offline or immutable backups reduce the value of encryption. Data minimization reduces the value of exfiltration. Rapid detection reduces dwell time. Crisis rehearsals reduce confusion. Vendor controls reduce supply-chain access. None of these measures makes compromise impossible, but together they change the expected payoff of attacking the organization.

That framing also improves budgeting. Security teams often compete for resources by listing threats, a method that can make every proposal sound urgent. A leverage model asks instead how a control changes expected loss or recovery options. It forces trade-offs into the open. Spending on prevention may be less valuable than spending on restoration if entry is assumed inevitable; the reverse may be true in a highly exposed identity environment. The point is not to calculate a fake precision estimate. It is to connect technical controls to the economics of extortion. We Know You Can Pay a Million earns its place in an executive library when it changes the question from “How do we stop hackers?” to “How do we make our organization a worse business proposition for an extortionist?”

The hidden variable: time

Ransomware negotiations are also markets in time. Attackers try to turn operational deadlines into pricing power: payroll, manufacturing schedules, hospital care, regulatory reporting, customer commitments and public disclosure can all make delay expensive. Defenders gain leverage when they can lengthen their decision window without increasing damage. That is why restoration testing, alternative communications, manual workarounds and pre-arranged incident teams are economic controls as much as technical ones. They buy optionality.

Executives should measure that optionality in advance. How many hours can a critical function operate without the primary system? When does a backup become usable? Which decisions can be made with incomplete forensic information? Which customers must be notified, and on what timeline? A company that knows these thresholds is harder to rush into a bad bargain. Shortland’s bargaining framework makes the insight clear: preparedness is valuable not only because it prevents loss, but because it changes the shape of the negotiation when prevention fails.

Who should read this book?

We Know You Can Pay a Million is aimed at boards, CFOs, security leaders, insurers, incident-response teams and executives who may someday face an extortion decision under severe time pressure. Technical readers will recognize the attack mechanics, but the distinctive payoff is economic: pricing, credibility, negotiation and recovery options. It is especially useful for leaders who still think ransomware is only an IT problem.

Millionaire Lesson verdict

We Know You Can Pay a Million is a high-value executive read because it models ransomware as an economy rather than a mysterious technical event. Shortland’s bargaining lens clarifies why resilience, information, insurance and credibility affect price. The best takeaway is not a negotiation trick; it is the need to reduce attacker leverage long before an incident creates a deadline.

FAQ

What is We Know You Can Pay a Million about?

What is the strongest idea in We Know You Can Pay a Million?

The strongest idea is that cybersecurity & ransomware economics becomes useful only when its mechanisms, incentives and failure conditions are made explicit rather than treated as a slogan.

What are the main limitations of We Know You Can Pay a Million?

The book is strongest as a mechanism-rich framework and weaker when vivid cases are treated as automatically transferable. Readers should test its claims against institutional context, independent data and counterexamples.

Who should read We Know You Can Pay a Million?

Founders, investors, executives, policymakers and operators who want a source-backed framework for making decisions under institutional, economic or technological uncertainty.

Sources and further reading

• Hachette — We Know You Can Pay a Million
• Google Books — We Know You Can Pay a Million
• The Guardian — review
• FBI — 2025 IC3 Annual Report
• CISA — StopRansomware Guide
• Chainalysis — 2026 Crypto Crime Report: Ransomware
• FinCEN — Ransomware Trends in BSA Data
• FinCEN — Financial Trend Analyses
• NIST — Cybersecurity Framework

Editorial note: source links are provided for verification and further reading. No personal reading experience, sales figure, rating, price claim or invented ASIN is asserted in this review.