The individual party incentives in ransomware are all to pay it, which encourages future attacks, only the long-term, societal view discourages payment. The vi

The individual party incentives in ransomware are all to pay it, which encourages future attacks, only the long-term, societal view discourages payment. The victim (individual organization or SaaS provider) wants to just have it end. The ransomer has the incentive to build the pattern of "pay the ransom and nobody gets hurt [in this incident]", because it builds the business model. Cybersecurity insurance exacerbates the problem, because the insurer knows that payouts solve the incident for the insured at a relatively low cost, and that each incident perversely increases the need organizations have for the insurance. Conversely, if no one pays ransoms, it immediately ceases being a viable criminal business model.