Many incident response plans focus on what to do after an attack starts. Isolate the infected devices. Contact your IR firm. Notify legal. All sound advice, but only useful if you already know who to call, where your backups live, and which systems the business cannot survive without.

Ransomware demands surged 47% last year. And yet, a record number of organizations refused to pay them. You’d think those two trends would push costs down. They haven’t.