Despite the guidance and best practice, an alarming proportion of businesses hit with ransomware simply pay to make it go away.