Not having updated the system (within reason: it _can_ take a week, but it should _not_ take a year) is gross negligence as far as vendor liability would be con

Not having updated the system (within reason: it _can_ take a week, but it should _not_ take a year) is gross negligence as far as vendor liability would be concerned. But by all means, let's limit the minimum liability for software vendors for such scenarios to "costs of downtime and effort for reinstalling backups and getting everything up again": That should provide an incentive to make backup procedures effortless and have the systems make some noise if they aren't backed up (with regular recovery testing etc). As it stands, software vendors say "users are to blame" as if their shitty software isn't enabling ransomware, users say "can't do anything about it, we're down for the next 6 months" as if ransomware is some force of nature (or act of God or whatever), when both positions, while not entirely untrue, are mostly lazy.