Comment & Analysis: Govt Ransom Ban Will Prompt Rethink on Policy Wording

Public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, would be banned from paying ransom demands to criminals under the measures. Under the proposals, businesses not covered by the ban would be required to notify the government of any intent to pay a ransom. Here are some comments from Intersys;

Matthew Geyman, Managing Director, Intersys, said: “Ransomware is probably the most serious organised cybercrime threat likely to impact an organisation. Following public consultation, the UK government’s proposal to ban ransom payments by public sector bodies – and mandate reporting – is a defining moment in the fight against this fraudulent scourge, and begins to define a more rigorous approach to an escalating systemic problem.

It also places fresh scrutiny on how the insurance sector approaches cyber risk. As attackers – often serious organised crime – shift focus to the private sector, insurers must reassess underwriting strategies to ensure organisations demonstrate robust cyber hygiene before cover is issued.

This reassessment is vital given the evolving threat landscape: ransomware software can now be purchased and deployed by threat actors with little to no programming knowledge, lowering the barrier to entry and increasing the frequency of attacks. Critically, there is no guarantee that paying a ransom will successfully unencrypt data. The decryption tools may not work as intended, and once the ransom has been paid, the attackers have no real incentive to offer assistance.

This isn’t just about setting premiums – it’s about avoiding policy wordings or claims processes that could inadvertently facilitate ransom payments or be seen to endorse them. Clear boundaries are now essential. With tougher legislation on the horizon, insurers must double down on resilience-based underwriting and ensure clients are equipped to recover quickly and lawfully from an attack. The same principle applies internally: insurers must also strengthen their own cyber defences, as the risk of becoming a ransomware target is just as real for them as for their policyholders.”