Capital Saturation, Tactical Substitution, and Asymmetric Harm in Ransomware Payment Policy A Theoretical Analysis of Economic Incentives: The North Wind and the Sun in the Economics of Cybercrime

Policies discouraging ransomware payments are commonly justified as a means of reducing attackers’ expected revenue. Lower criminal revenue, however, does not necessarily translate into lower social harm. This theoretical paper reexamines ransomware payment policy by considering criminal organizations’ existing capital stocks, their capacity to manage sudden financial inflows, the substitutability of targets and extortion tactics, variation in offenders’ motives, and harms borne by third parties. It advances four falsifiable hypotheses: (H1) capital saturation may reduce the marginal incentive to undertake additional attacks; (H2) sudden capital inflows may increase internal governance costs and destabilize criminal organizations; (H3) declining expectations of payment may induce substitution across targets and extortion methods rather than exit alone; and (H4) the deterrent effect of nonpayment may vary with the importance of nonfinancial motives. The analysis also incorporates a mismatch between organizational payment decisions and the costs borne by customers, employees, and other affected individuals. A framework based on expected social loss is proposed to evaluate these competing effects. Observed trends in 2025 ransomware payments and publicly claimed attacks are consistent with a need to distinguish revenue from harm, but do not establish causation or confirm any hypothesis. The paper does not recommend payment; rather, it sets out a research agenda that separates deterrence, victim protection, and investment in security.