IR Firm Reference · Veeam · Updated July 2026

Coveware Incident Response Cost: What You'll Actually Pay

Coveware (now part of Veeam) is the market reference for ransomware negotiation and recovery. It is not a full-scope DFIR firm: it specialises in threat-actor negotiation, payment logistics, and decryption, and is usually paired with a technical IR partner for forensics and eradication. Its quarterly marketplace report is itself a primary data source, so the ransom figures below are verified, not estimated.

How much does Coveware cost? Coveware charges a project or success-based fee for ransomware negotiation and recovery rather than a published hourly rate, and it is typically engaged alongside a separate DFIR firm that handles forensics and eradication. The larger cost in a ransomware case is usually the ransom itself, which averaged $1,880,612 with a median of $150,000 in Q2 2026 per Coveware's own marketplace data.

$1,880,612

Avg ransom paid (Q2 2026)

$150,000

Median ransom (Q2 2026)

15%

Exfil-only pay rate (Q2 2026 low)

Negotiation focus

Specialism

Figures marked (est.) are planning estimates triangulated from public data sheets, RFP responses, and breach disclosures, not vendor-confirmed list prices; where a firm publishes a list price or names its pricing model, we cite that directly. Always get a written quote for your estate.

Pricing Models

Model	Cost	Notes
Ransomware negotiation engagement	Project / success-based (est.)	Negotiation, threat-actor profiling, and payment logistics.
Average ransom payment (Q2 2026)	$1,880,612 (verified)	Coveware Q2 2026 marketplace data; +176% on Q1 2026 as a handful of very large law-firm extortion settlements pulled the mean up.
Median ransom payment (Q2 2026)	$150,000 (verified)	Median fell about 50% from Q1 2026 as more mid-market victims refused to pay for data-theft-only extortion.
Payment rate (Q2 2026)	Record low (verified)	Overall share of victims that paid hit a new record low; the data-exfiltration-only rate fell to 15%.

What You'll Actually Pay: Worked Scenarios

Scenario	Estimate	Basis
SMB ransomware, negotiation only	Negotiation fee + ransom decision	Coveware negotiates; you still need a DFIR partner for eradication.
Mid-market ransomware, paired engagement	DFIR firm ($60K-$250K) + Coveware negotiation	Typical pairing: technical IR firm plus Coveware for the ransom track.
Ransom payment itself	Median $150,000 / Avg $1,880,612 (Q2 2026)	Extremely skewed; a few large law-firm settlements pull the mean far above the median.

Verified Facts

The Q2 2026 average ransom payment was $1,880,612, up 176% from Q1 2026. — Coveware Q2 2026 Marketplace Report

The Q2 2026 median ransom payment was $150,000, down roughly 50% from the prior quarter. — Coveware Q2 2026 Marketplace Report

The Q2 2026 overall payment rate hit a new record low; the data-exfiltration-only rate fell to 15%. — Coveware Q2 2026 Marketplace Report

When Coveware Is the Right Pick

Right pick when

+You face an active ransomware demand and need expert negotiation and payment logistics.
+You want sanctions-screening and threat-actor reliability assessment before any payment.
+You already have a DFIR firm for forensics and need the ransom track handled.

Wrong pick when

−You need full-scope forensics and eradication (pair Coveware with a DFIR firm).
−Your incident is a breach or outage with no ransom component.
−You want a single vendor for the entire response lifecycle.

Frequently Asked Questions

How much does Coveware cost?

Coveware charges a project or success-based fee for ransomware negotiation and recovery rather than a published hourly rate, and it is typically engaged alongside a separate DFIR firm that handles forensics and eradication. The larger cost in a ransomware case is usually the ransom itself, which averaged $1,880,612 with a median of $150,000 in Q2 2026 per Coveware's own marketplace data.

What is the latest average ransom payment?

The average ransom payment was $1,880,612 in Q2 2026, up 176% from the prior quarter, while the median was $150,000, down roughly 50%, according to Coveware's Q2 2026 marketplace report. The gap between mean and median is unusually large because a small number of multi-million-dollar law-firm settlements pull the average well above the typical payment most victims actually face.

Does Coveware do forensics?

No, Coveware specialises in ransomware negotiation, threat-actor profiling, sanctions screening, and payment logistics rather than full forensics and eradication. Most engagements pair Coveware for the ransom track with a technical DFIR firm such as Mandiant, CrowdStrike, or Kroll for the forensics, containment, and recovery work, so the two costs are additive.

Should you pay a ransom?

The overall ransom payment rate hit a new record low in Q2 2026, with the data-exfiltration-only rate falling to 15%, reflecting that most victims still decline to pay, often because backups and law-enforcement guidance make recovery viable without payment. Coveware's role is to inform that decision with threat-actor reliability data and sanctions screening; paying a sanctioned entity can itself create legal exposure regardless of the ransom amount.

Compare Other IR Firms

Mandiant

Tier-1 DFIR, authors of the M-Trends report

CrowdStrike Services

Falcon-integrated IR and proactive retainer

Kroll

Cyber risk retainer with breach notification services

Unit 42

Palo Alto Networks DFIR and proactive retainer

Sophos

Fixed-fee Rapid Response IR plus MDR (Secureworks Taegis)

Arctic Wolf

MDR with incident response included

Sources: Coveware Q2 2026 Ransomware Marketplace Report; Coveware (Veeam) public reporting; IncidentCost.com triangulation for engagement-fee structure. Updated July 2026.

IncidentCost.com is independent and not affiliated with Coveware or Veeam. All figures are for planning purposes only.