Comment by abarringer

Companies purchase cyber insurance for a small fee and avoid risk of paying ransoms directly.

Make cyber insurance paying ransoms illegal and you'll see boards start funding IT security.