The affiliate arithmetic runs on a napkin. An operator paid only when a victim pays has to rank prospects by payment probability per unit of effort, and the inputs to that ranking are visible from outside the perimeter: stable revenue, whether the business stops when its systems stop, and whether a policy exists that will fund the transfer [3][8]. This ranking runs on payment probability, not the criteria defenders typically use to flag an attractive target [7].
Access brokers and double extortion reinforce that same logic. Initial access brokers sell entry, which lowers the technical bar for selection and lets one affiliate work more prospects than it could otherwise reach [4]. Double extortion removes backups as a conversation-ender, because the stolen copy still has to be paid for [5].
The evidence the feature puts behind volume behavior is coverage breadth. The FBI IC3 2025 Internet Crime Report records ransomware victims across 14 of the 16 critical infrastructure sectors, with healthcare, government services and financial services among the most frequently reported [9]. That is 87.5 percent of sectors, two unrepresented [10]. Coverage that wide fits selection by payer rather than by symbol. It also fits several other explanations, since a victim distribution is not a causal chain.
Separate the measured from the asserted. The sector spread is published federal data [9]. The within-sector pattern, regional hospital systems and specialty practices ahead of major medical centers, credit unions and community banks ahead of larger institutions, arrives without a figure attached, and the financial-sector passage in the material supplied breaks off mid-sentence [11][12]. The passage doesn't name a group, cite a CVE, or date an incident [16]. Read it as a targeting model rather than as telemetry.
What survives the sourcing caveat is the allocation critique, and it is the part worth acting on [13]. A program that protects by data sensitivity ends up with heavy controls on the sensitive archive and lighter ones on the scheduling, dispatch or billing system whose outage forces the payment decision, which is exactly where the attack path then runs [13]. The source's own comparison carries it: a defense contractor can compartmentalize damage and let legal process run the clock, and a regional hospital cannot stop seeing patients [15]. The inventory that follows from that is ordered by restore urgency, not by classification level.
The affiliate is already estimating what an organization would pay and how quickly. According to SC Media, that estimate is the real risk assessment, more so than any org chart [14].
