Back to webinars

Webinar

The Ransomware Report H2 2025: Why the drop in victims isn’t a win

January 9, 2026

Luke Donovan
LD

Speaker

Luke Donovan

Head of Threat Intelligence at Searchlight Cyber

Share on social

Join the newsletter

Overview

Fewer victims in H2 2025 might look like progress – but year-over-year totals were still up 30%, plateauing at the highest baseline Searchlight's security team has ever seen.

In this webinar, we'll show why fewer victims in H2 than H1 isn't the success story it sounds like. Year-over-year, the total victim count was up, and this trend shows no signs of slowing. Treating that as "a win" is how defenders and criminal investigation teams misread the threat – and make budgeting and prioritization decisions at exactly the wrong moment.

Join Searchlight's Head of Threat Intelligence and Data Collection, Luke Donovan, to stay ahead of ransomware and discover:

  • The top 5 groups of H2 2025 and their evolving attack strategies
  • Insights on emerging ransomware groups
  • How to leverage vulnerability and breached file data to preempt attacks
Luke Donovan
LD

Speaker

Luke Donovan

Head of Threat Intelligence at Searchlight Cyber

Luke Donovan is Head of Threat intelligence at Searchlight Cyber. Luke’s background is in military intelligence and security within the British Army, where he served in Afghanistan, Libya, and the Middle East, supporting counter-terrorism and narcotics efforts. He later transitioned to the cyber sector and now leads our expert team of threat intelligence analysts at Searchlight.

Related Webinars

Cyberattacks and retaining customer loyalty - the hidden cost no one is talking about

Cyberattacks and retaining customer loyalty - the hidden cost no one is talking about

How dark web intelligence powers preemptive threat exposure management

How dark web intelligence powers preemptive threat exposure management

Test Your Attack Surface: Security Tools to Validate Exposures

Test Your Attack Surface: Security Tools to Validate Exposures

Ransomware: Preparing for the inevitable with Dr. Mike Saylor

Ransomware: Preparing for the inevitable with Dr. Mike Saylor

How to measure the ROI of your Attack Surface Program (ASM)

How to measure the ROI of your Attack Surface Program (ASM)

The Ransomware Report H1 2025: Trends, Groups & Insights

The Ransomware Report H1 2025: Trends, Groups & Insights

Christmas in July - Critical vulnerabilities unwrapped

Christmas in July - Critical vulnerabilities unwrapped

Beyond ASM: What CTEM means for your external risk strategy

Beyond ASM: What CTEM means for your external risk strategy

Surfacing Security (series one) - Attack Surface Management (ASM) and beyond

Surfacing Security (series one) - Attack Surface Management (ASM) and beyond

Legacy vs modern Attack Surface Management: What is true ASM?

Legacy vs modern Attack Surface Management: What is true ASM?

Discover the benefits of Searchlight Cyber's Partner Program

Discover the benefits of Searchlight Cyber's Partner Program

Where is cybercrime coming from in 2025?

Where is cybercrime coming from in 2025?

The Ransomware Report 2025: Dark Web Trends, Groups & Insights

The Ransomware Report 2025: Dark Web Trends, Groups & Insights

The 12 Days of Dark Web FAQ: A mini webinar series

The 12 Days of Dark Web FAQ: A mini webinar series

How to identify criminals talking about your business on the dark web

How to identify criminals talking about your business on the dark web

Correlating cybersecurity risk and dark web exposure with Marsh McLennan

Correlating cybersecurity risk and dark web exposure with Marsh McLennan

Criminality on the dark web in 2024: Drugs, Fraud, and Trafficking

Criminality on the dark web in 2024: Drugs, Fraud, and Trafficking

The Changing Landscape of Dark Web Forums and Marketplaces

The Changing Landscape of Dark Web Forums and Marketplaces

How LEA, government, and enterprises gather evidence from the dark web

How LEA, government, and enterprises gather evidence from the dark web

Gaining Visibility of the Entire Ransomware Kill Chain

Gaining Visibility of the Entire Ransomware Kill Chain

How to Elevate Cyber Threat Intelligence in Your Organization

How to Elevate Cyber Threat Intelligence in Your Organization

Initial Access Brokers and Infostealers: Your Business for Sale on the Dark Web

Initial Access Brokers and Infostealers: Your Business for Sale on the Dark Web

Spotting Insider Threats on the Dark Web

Spotting Insider Threats on the Dark Web

Never miss a beat

Get all news and updates about Searchlight Cyber, directly in your inbox.

Subscribe
Please enter a valid email address.
Background Gradient