Coveware vs. GroupSense vs. Arete: Ransomware Negotiation Firms Compared

Public information on all three firms is uneven. None of them publish a rate card, and case-level outcome statistics are not independently audited by a third party. The comparison below reflects what is publicly documented about each firm's model, not a claim about which negotiates better outcomes.

The surface-level service, talking to the threat actor and trying to bring the demand down, looks similar across all three firms. The mechanics behind that conversation differ in ways that matter once an incident is live.

Coveware's process centers on threat-actor profiling built from its own case history: because the firm has handled a large volume of ransomware cases across many different operator groups, it can often tell a client early whether a specific group has a track record of honoring payment (providing a working decryptor and not re-extorting) or a track record of taking payment and disappearing or leaking data anyway. That case-history angle is the same asset that feeds its public quarterly report.

GroupSense's process leans on its threat-intelligence platform first. Because the firm already runs dark web and closed-source monitoring as its primary business line, it can often identify which specific criminal group or affiliate is behind an attack, cross-reference that group against known sanctions designations and prior extortion behavior, and build the negotiation posture around that intelligence rather than around negotiation case volume alone.

Arete's process is the one most likely to happen inside a single, unified engagement: the same firm that is doing memory forensics and log analysis to scope the intrusion is also the one at the negotiating table, which can shorten the handoff between scoping and negotiation but also means a client is trusting one vendor for both jobs instead of a specialist plus a forensics firm checking each other's work.

This is the point legal counsel should press hardest on, and it is the reason a specialized negotiation firm is not interchangeable with a general IR retainer. The Treasury Department's Office of Foreign Assets Control has advised for years that facilitating a ransomware payment to a sanctioned person or entity, or to a group operating out of a comprehensively sanctioned jurisdiction, can itself create civil liability under a strict-liability sanctions regime, regardless of whether the victim organization knew the counterparty was sanctioned. OFAC's advisory explicitly calls out incident response and cyber insurance firms as parties whose due diligence practices factor into that liability exposure, and it treats a documented, good-faith compliance program (reporting to law enforcement, engaging OFAC before payment when a match is suspected) as a mitigating factor in any enforcement decision.

What this means in practice is that a negotiation firm's sanctions-screening process is not a compliance footnote, it is close to the core product. Coveware and GroupSense both describe screening the threat actor or their wallet infrastructure against sanctions lists and known-actor intelligence before facilitating any payment, though neither publishes the specifics of that screening methodology, its false-negative rate, or how it is documented for a client's legal file. Arete's due diligence approach has historically included direct engagement with federal law enforcement, cross-checking threat-actor identity and infrastructure with the FBI as part of building the record, according to public statements from the firm's leadership in earlier ransomware negotiation coverage.

The honest takeaway: all three firms claim to perform sanctions due diligence, none of them publish an auditable methodology, and legal counsel should treat the specifics of that screening process, not the marketing language around it, as a required discovery item during vendor selection. Ask each firm directly how a sanctions match is identified, who signs off before a payment is made despite ambiguity, and what documentation the client receives afterward for their own OFAC compliance file.

Coveware's quarterly ransomware marketplace report is the one place among these three firms where a genuinely public, recurring data product exists. The report tracks metrics like average and median ransom payment, the share of victims who pay at all, and the split between encryption-only, data-exfiltration-only, and combined extortion cases, drawing on the firm's own negotiation case volume. That gives a prospective client something concrete to evaluate before signing a retainer: years of published trend data that can be checked against other public sources (law enforcement reporting, cyber insurance claims data) for directional consistency, even though the underlying case-level data is proprietary and not independently audited.

GroupSense's public data output leans toward threat-actor and victim-count tracking tied to its dark web monitoring rather than payment-outcome statistics, which is a different kind of usefulness: it tells a prospective client more about which ransomware groups are currently active and targeting which sectors than about typical payment amounts or negotiation outcomes.

Arete does not appear to publish a comparable recurring public dataset. Its data advantage, to the extent one exists, is internal to the firm's own case history and is not offered as a standalone public research product the way Coveware's report is. That does not make Arete's negotiation experience less real, but it does mean a prospective client cannot independently sample Arete's track record the way they can skim several quarters of Coveware's published numbers before ever picking up the phone.

None of these three firms publish a rate card, and that is worth saying directly rather than guessing at numbers. What is publicly documented is the general shape of the fee model rather than specific rates.

Coveware is described in third-party reporting as charging a project or success-based fee for negotiation and recovery work rather than a published hourly rate, with actual pricing quoted per engagement. Public information does not specify whether that success fee is structured as a flat amount, a percentage of the ransom reduction achieved, or a percentage of the final payment amount, and prospective clients should get that structure in writing before an incident rather than assuming a percentage-of-ransom model applies by default.

GroupSense and Arete do not have similarly documented public fee structures available from the sources reviewed for this piece. Both firms, like most incident response vendors, appear to negotiate engagement terms directly with each client, and neither publishes example pricing. Any specific percentage or flat-fee figure attributed to either firm without a citable public source should be treated as unverified. The practical fix is the same for all three: get a written fee-structure term sheet during the pre-incident retainer conversation, not during an active extortion event when negotiating leverage over the vendor's own fee is at its weakest.

No single firm wins this comparison outright. Each has a strength that maps to a specific buying scenario, and a corresponding limit worth weighing against it.

The right choice depends heavily on what an organization already has in place and how it weighs vendor consolidation against specialist depth.

Selecting a negotiation firm before an incident, rather than during one, is the entire point of this comparison. The checklist below is what to work through during that calmer pre-incident window.