Expert adversary negotiation, sanctions compliance, and crypto advisory. We lower demands, validate decryptors, and never charge success fees.
A ransomware demand puts you under extreme pressure at precisely the moment you need to think clearly. The threat actor's leverage is time. They know that every hour of downtime costs you money, and they use that to push for faster, larger payments.
Inexperienced or panicked negotiation accelerates that pressure and typically results in higher payments, worse decryptors, and slower recovery. Our negotiators have handled dozens of active ransomware cases. We know which threat actors respond to which approaches — and which ones to push back against.
A flat engagement fee covers the full negotiation — threat actor profiling, sanctions screening, all communications, decryptor validation, and incident documentation. Agreed upfront, no surprises.
Where clients prefer outcome-aligned pricing, we offer a small tiered percentage on the discount achieved from the original demand:
| Discount Achieved | Performance Fee |
|---|---|
| Up to 30% | 5% of discount amount |
| 31% – 60% | 4% of discount amount |
| 61% – 80% | 3% of discount amount |
| Over 80% | 2% of discount amount |
Example: Demand £500,000 → Negotiated to £100,000 → Discount = £400,000 (80%)
Performance component: 3% × £400,000 = £12,000
Everything is agreed in writing before we begin. Our incentive is always to minimise your total loss. Verify the fee structure of any negotiation firm you consider.
Every engagement begins with a sanctions screening process. We check the threat actor, associated wallets, and any infrastructure against OFAC (US), OFSI (UK), and EU consolidated sanction lists. We document this process fully and will not facilitate a payment where sanctions risk cannot be mitigated.
If a sanctions issue is identified, we advise you on legal position and work with your legal counsel. We have existing relationships with specialist sanctions lawyers.
Not always. If backups are clean and recovery is faster than negotiation, paying is rarely the right answer. We assess your recovery options alongside negotiation and give you an honest picture of both paths. We won't push you toward payment if recovery is viable.
There's no evidence that negotiating once makes you more likely to be targeted again — attackers choose victims based on opportunistic access, not payment history. What matters is remediating the initial access vector, which we work on in parallel.
Decryptor reliability varies by group and by encryption key implementation. We always test on a sample of encrypted files before any payment. If the test decryptor fails, we renegotiate. We document this for your insurer.
Yes. We take over or advise on existing communications. The earlier you bring us in the better, but we can course-correct even if the negotiation has started.
Most negotiations reach a resolution within 3–10 days. We keep parallel recovery efforts running throughout so your recovery timeline isn't solely dependent on the negotiation outcome.