The Extortion Funnel

To predict ransomware you have to stop thinking of it as vandalism and start thinking of it as commerce. The people running mature ransomware operations are not motivated by spectacle. They are motivated by margin, and once you accept that their behavior becomes almost boringly predictable — which is exactly what you want from a threat. A predictable adversary is a manageable one.

Begin with the shift from artisanal to industrial. Early computer extortion was handmade: a skilled individual picked a target, broke in by hand, and demanded money. That does not scale, for the same reason a chef who personally cooks every meal cannot feed a nation. Scaling required doing to extortion what the factory did to manufacturing — breaking the work into repeatable steps, automating the repeatable ones, and specializing the rest. The result is an industry with a division of labor. Some groups write the malware. Others rent it out to affiliates who do the breaking-in, splitting the proceeds — extortion as a franchise. Others run the negotiation. Others launder the payment. Each does one thing well, and the whole assembly line converts effort into revenue at a rate a lone operator could never match.

Think of it as a funnel, the same shape any sales organization would recognize. At the wide top, automated tools scan the entire internet cheaply, looking for any reachable, exploitable system. Automation is the key economic fact here: it costs almost nothing to knock on a million doors, so the attacker knocks on all of them and doesn't care which open. This is why so much ransomware feels impersonal — because it is. You were not chosen for who you are. You were chosen because a door was unlocked and a machine found it. Faraday's read: most victims are not hunted, they are harvested. Taking it personally misreads the economics; you were a row in a spreadsheet, selected by a script that never learned your name.

Down the funnel, an opened door becomes an intrusion, an intrusion becomes access, access becomes control, and control becomes the demand for money. At each stage the operation drops the targets that aren't worth the effort and concentrates on the ones that are. And at the narrow bottom sits the only step that produces revenue: the payment. Everything upstream is cost. The entire apparatus exists to manufacture, as efficiently as possible, a moment where a victim decides that paying is their least-bad option.

This is why understanding the model matters operationally rather than academically. Because it is a business optimizing for profit, it behaves rationally, and rational behavior is forecastable. A business minimizes cost, so ransomware automates the cheap steps and reserves human attention for high-value victims. A business maximizes the chance of getting paid, so it does the things that make paying more likely and refusing more painful — which, as the next lesson shows, is the whole reason backups get hunted first. A business responds to incentives, so the balance of what you make expensive versus what you make cheap for the attacker shapes the threat you actually face.

There's a further wrinkle that the business lens predicts: the model evolves toward whatever pays. When victims got better at restoring from backups and refusing to pay, the industry did not fold. It added a second revenue line — steal the data before encrypting it, and threaten to publish it. Now refusing to pay no longer just costs you a rebuild; it costs you exposure. That is not a new grudge. It is a product team finding a second thing to charge for when the first thing lost pricing power. Extortion, like any business, diversifies its revenue when a channel weakens.

The empiricist's takeaway is calm, and it is meant to be. A grudge is unpredictable; a business is not. Once you see the funnel, the spreadsheet, and the margin, you can ask the useful question at every one of your own leverage points: what would this cost the attacker, and what would it earn them? Raise their cost, cut their expected revenue, and much of the threat routes around you toward a softer, more profitable row in the spreadsheet — not because you're invulnerable, but because you stopped being worth the effort. The domain thesis holds: the incidents that already happened to others are the cheapest intelligence you have about the business that will, eventually, come knocking on your doors too.