Paying the ransom doesn't cover the need to spend money on fixing the problems. Having a ransom payer mark on the organization raises the security requirement,

Paying the ransom doesn't cover the need to spend money on fixing the problems. Having a ransom payer mark on the organization raises the security requirement, doesn't it?