Markup is the extra amount added on top of an underlying cost or expense. In cybersecurity, the term often appears in recovery, consulting, or resale services, where a provider charges more than the base cost of tools, labor, or access.
It matters because attackers and opportunistic intermediaries can use markup to turn an incident into a second source of profit. During ransomware recovery, for example, victims may be billed inflated fees for cleanup, validation, or decryption support, and a fake decryptor may hide either a bogus service or a large surcharge. Defenders should compare invoices, verify providers, preserve evidence, and separate technical remediation from urgent commercial pressure.