Ransomware affiliates buy access on economics - what do you tell a board that hardening will change?

## Why the board's question is a good one "Does hardening just send them next door?" sounds cynical but it is the right economic question, and the answer is *partly yes, and that is worth paying for* - as long as you say precisely which part. ## The two populations **The volume buyer.** Rents a platform, buys listed access, needs many victims a year. Their margin is set by cost per victim, time from purchase to payment, and payment rate. They are indifferent between you and any comparable listing. For this population, **diversion is real**: the moment your access is not for sale at a price that supports their margin, they buy someone else's. You have not defeated them; you have exited the inventory pool. That is a legitimate and cost-effective outcome to buy. **The buyer who prices you specifically.** Their expected payout scales with your revenue, your dependence on uptime, or how badly disclosure would hurt you. If the prize is large enough to fund weeks of bespoke effort, hardening changes the *cost* of reaching you rather than the *decision* to try. You are not diverted; you are made expensive. The uncomfortable implication for a board: the more your organisation is worth extorting, the less of the benefit comes from diversion and the more comes from raising cost and shortening the intruder's useful time. ## What to actually commit to A principal-level answer commits to claims that can be defended a year later: 1. **"We will stop being cheap."** Removing what a purchase depends on - phishing-resistant authentication (FIDO2/WebAuthn) so a harvested secret is not sufficient, no internet-reachable single-factor remote access, supplier and contractor access held to the same bar - takes away the sellable good. That is measurable as an exposure statement, not as an absence of attacks. 2. **"We cannot commit to not being worth it."** Deterrence is not ours to promise. Anyone who tells a board that hardening removes the threat has made a claim they will have to retract. 3. **"Recovery alone does not remove the payment pressure."** Extortion escalates through layers priced against different fears - loss of operations, disclosure, and pressure applied through customers, partners or regulators. A firm whose data is unremarkable is squeezed on uptime; a firm holding sensitive material is squeezed on silence even when its systems come back. Buying only recovery capability answers the first layer and leaves the others intact, and a board that thinks it has bought immunity will be surprised at exactly the wrong moment. ## Where the money goes, and why The chain is severable, and its layers are not equally expensive for the adversary to replace: | Layer removed | What the adversary must do instead | | --- | --- | | Sellable entry (reusable secrets, reachable single-factor remote access) | Buy a different victim, or fund original entry work against you | | Freedom of movement once inside | Spend more time, with more chance of being stopped mid-operation | | The last step - the encryptor itself | Request a fresh build; the platform supplies it at no meaningful cost | Spend concentrates at the top of that table, because that is where substitution is expensive for them. Spend aimed at the bottom row is aimed at the one component the market reproduces for free. ## Handling the two objections you will get **"So we are just pushing the harm onto a smaller company."** True at the margin, and it is worth saying out loud rather than dodging. The board is accountable for this organisation; the market-level answer - reducing the total pool of sellable access - only comes from many organisations doing the same thing, which is the argument for sector-level baselines rather than for doing nothing here. **"Then how do we know it worked?"** Not from a quiet year, which proves nothing on its own. Judge it on the exposure statement you can demonstrate: what fraction of remote access can still be used with a secret alone, how much supplier access sits outside that bar, how long a harvested credential would remain usable. Those are properties of the estate you can assert and re-assert, and they are the properties the purchase depends on. ## The sentence to have ready "Hardening reliably diverts the volume buyer, because it takes our access out of the inventory they shop from. It does not deter anyone whose payout is priced against our revenue - for them it buys cost and time. I will commit to the first and I will not promise the second."