5 Whys of Never Paying Ransomware

As the ‘Never Pay’ ransomware debate continues, we offer an interrogative point of view based on the 5 Whys method of root cause/effect dissection. Here goes:

Why is paying the ransom an option a company needs to consider?

Because the company did not sufficiently invest in security and business continuity, and now they are at risk of existential data loss.

Why did the company fail to make these investments?

Because the company did not think these investments were a priority relative to other expenses in their budget.

Why did the company not make them a priority?

Because the company did not correctly assess the probability of sustaining a ransomware attack and its costs vs. the upfront investment in security and continuity.

Why did the company fail to make the correct assessment?

Because the company had neither ready access to the information necessary to make an educated assessment or inexpensive enough security and continuity options to make an easy decision.

Why did the company not have good information or easily implementable security and continuity products?

Well, our 5 Whys are up and we are now at the root.

We need better ransomware data, and to broadcast it more effectively. 

Coveware was founded on the premise of filling the data gap and broadcasting actionable information about ransomware and ransomware incidents. Data-driven decision making can make the collective security, continuity, and recovery industries more supportive of SMBs. We feel it is the right start, but have a lot of work to do.

We need cheaper, easier-to-implement security and continuity tools.

Lowering the bar to adoption is the responsibility of any manufacturer in the security or continuity industry. Tools should be affordable; equally as important, they should be easily implemented. It’s just too easy for businesses to assume they are not targets and delay investment because of cost or hassle.