Survey: 57% of CISOs Report Ransomware Starting on Endpoint Devices

Summary

An Absolute Security survey of 750 US and UK CISOs found 57% reported ransomware starting on remote, mobile, or hybrid endpoints; 58% would consider paying, and 20% said recovery took up to two weeks.

Key points

In the survey, 57% of CISOs said their enterprises experienced ransomware that originated on a remote, mobile, or hybrid device in the previous 12–18 months.
58% said they would consider paying a ransom to end an incident; 46% ranked operational downtime as ransomware’s most significant likely impact.
83% were confident their organizations could recover, yet 57% said recovery took as long as six days and 20% as long as two weeks; none reported recovery within a day.
59% said physical possession of an endpoint was required for remediation and restoration, while 53% reported having remote recovery capabilities.
CISOs ranked employee awareness training (43%) and legacy-system patching (42%) as their top ransomware mitigation challenges.
The report also cites separate telemetry research finding that critical endpoint security controls fail to operate 20% of the time.

Article Details

Publisher: Absolute Security
Report Period: The 12–18 months preceding the May 2026 report
Scope: Survey findings on ransomware experiences, recovery, and mitigation among enterprise CISOs in the United States and United Kingdom.
Sample Size: 750 enterprise CISOs; survey conducted by Censuswide.
Key Statistics: 57% reported ransomware attacks originating on remote, mobile, or hybrid devices during the preceding 12–18 months.
58% said they would consider paying a ransom; 46% ranked operational downtime as ransomware’s most significant likely impact.
57% took as long as six days to recover, and 20% took as long as two weeks; no respondents reported being able to recover within a day.
59% said physical access to an endpoint was required for remediation and restoration; 53% reported having remote recovery capabilities.
43% ranked employee awareness training and 42% ranked legacy-system patching among their most challenging ransomware mitigation methods.
Recommendations: Keep patching a key security tactic, including addressing legacy-system vulnerabilities.
Prioritize the ability to recover from vulnerabilities and exploits and restore operational continuity.