Threat Vector by Palo Alto Networks Inside Ransomware Negotiations: Trust Criminals or Walk Away?
Mar 19, 2026
Jeremy D. Brown, Consulting Director at Unit 42 with extensive ransomware negotiation and incident response experience. He recounts how initial contact yields forensic clues and which attacker playbooks are most common. He explains timing, who should be at the table, why politeness helps, and which groups are too risky or sanctioned to engage.
AI Snips
Chapters
Transcript
Episode notes
From Public Sector Rules To Private Sector Negotiator
- Jeremy D. Brown transitioned from public sector where negotiation was taboo to private sector where he learned to negotiate with criminals.
- He trained under a skilled mentor at Cripsis and pursued negotiations as a unique, recurring challenge.
Engage Attackers Through Professionals To Gather Intel
- Do engage threat actors through professionals to gather forensic intelligence without committing to payment.
- Jeremy D. Brown uses early contact to obtain file listings and indicators so clients can assess data in play and notification obligations.
Brief Executives With A Seasoned Negotiation Lead First
- Use experienced negotiation leads to brief leadership and counsel on expectations before contacting attackers.
- Jeremy D. Brown acts as executive advisor to explain threat actor playbooks, communications, and likely outcomes to calm the victim organization.