Let me start with the big takeaway: Don’t pay the ransom.

I say this knowing there are rare situations where leaders feel trapped. I’ve been in rooms with boards and ownership teams staring at a ransom note on the screen, watching the clock tick down, hearing criminals promise a decryption key if payment is wired. I’ve seen the stress and fear. I’ve witnessed family-owned companies worried that a generational legacy could disappear overnight.

But paying is almost never the right answer. And the evidence makes that clear.

Paying Puts A Target On Your Back

One number should freeze every executive in their tracks: Roughly 78% of organizations that pay a ransom get hit again. In a third of those cases, it’s the same hacker returning. In the remaining cases, it’s new attackers who now see you as an easy target.

If you’ll pay the ransom, why wouldn’t others go after you? You’re a soft target, not because of your technology, but because of your approach.

On the dark web, intelligence moves fast. Criminal groups track who pays, how quickly and how much leverage they hold. Paying sends a message that you have technology weaknesses, you’re willing to negotiate and you’ll choose short-term relief over long-term resilience. That combination is incredibly attractive to attackers.

Paying a ransom doesn’t give you a pass. It paints a target on your back.

Payment Doesn’t Fix The Root Cause

Ransomware attacks don’t occur by accident. A malicious actor finds a vulnerability, such as poor patching, outdated standards, successful phishing or exposed credentials, and exploits it. If a business doesn’t know how threat actors breached their business and raise those areas to a level of true resilience, those same exposures will continue to signal that you’re vulnerable.

Too often, organizations identify one root cause, fix that specific issue and move on. But cybersecurity depends on layers of protection contributing to a stronger system. If you had one significant vulnerability, you would likely have more than one. While paying the ransom and decrypting systems may get operations moving again, it doesn’t improve your overall cybersecurity posture. And if that posture doesn’t improve, you’re not solving the problem; you’re postponing it.

There’s also the uncomfortable reality that paying doesn’t guarantee a fix. You might receive a decryption key. You might not. Even if you do, attackers often retain copies of your data. That data can be sold, leaked or used as leverage again later. You may regain access to your systems while still carrying persistent exposure.

Criminals Exploit Fear And Urgency

When a ransomware attack occurs, it’s both a technology problem and a leadership emergency.

CIOs and IT leaders are under tremendous pressure. Revenue may be halted. Operations may be frozen. Boards ask whether it would be easier to pay and make the pain stop.

The attackers understand this. They monitor fear, urgency and emotional cues during negotiations. They set deadlines. They ratchet up the threats and play on reputational risk. Some industries, such as healthcare, often use vulnerable technology due to budget or other priorities. Some, like financial services, are perceived to have more cash. If you’re not prepared and thinking like an adversary before the incident, you are likely to negotiate based on fear. And that’s exactly where they want you.

The Impact Extends Beyond IT

When your systems are encrypted and you can’t do business, trading partners notice. Customers notice. Regulators notice. Large organizations increasingly demand audits and proof of resilience from their partners. A breach can trigger heightened scrutiny and potentially higher costs to maintain key relationships.

Inside the organization, the consequences can be equally challenging. The best practice during an incident is to keep communication tightly controlled on a need-to-know basis. But employees who suddenly cannot access systems and aren’t receiving much information may feel anxious and disconnected.

If leadership ultimately decides to pay, employees who understand that ransom payments fund organized crime may question that decision. Increasingly, people recognize that ransomware is fueling a much larger criminal ecosystem.

The Legal Risk Most Leaders Don’t See Coming

If the threat actor is foreign, ransom payments can trigger scrutiny from the U.S. Treasury’s Office of Foreign Assets Control (OFAC). Because OFAC operates under a strict liability standard, organizations can face civil penalties even if they didn’t know the attacker was a sanctioned entity. A payment meant to resolve a crisis then quickly becomes a regulatory risk event.

If the attacker is domestic, the Hobbs Act may apply. Since extortion is already illegal, knowingly transferring money that sustains that activity can expose the payer to legal scrutiny, similar to how authorities treat payments in kidnapping or extortion cases.

This is why legal counsel needs to be involved early—cyber-experienced legal counsel.

You’re Part Of A Larger War

This is the mindset shift I believe more leaders need to make.

A company experiencing ransomware is not dealing with a local inconvenience. You are part of a much larger war that involves a rapidly scaling, well-funded criminal economy. Ransom payments fund organized cybercrime networks. They improve attacker tooling. They industrialize the very threat that may come back to harm you or someone else in the future.

When companies pay, they might be solving their own short-term pain, but they are also contributing to the growth of an industry that becomes more dangerous each year.

To pay or not to pay isn’t only a business decision. It’s an ethical one.

Small And Mid-Sized Businesses Are Prime Targets

There’s a persistent myth that smaller organizations are insulated. The idea that “we’re just a small business” no longer holds.

Automation, AI-enabled scanning tools and ransomware-as-a-service platforms have leveled the playing field. Small and mid-sized companies are often easier targets. Many are large enough to pay significant sums but lack the defensive maturity of global enterprises.

These organizations are also frequently underserved when it comes to cybersecurity talent. Skilled practitioners gravitate toward consulting and managed services environments where they can work on real incidents and keep their skills sharp. Corporate teams often struggle to attract and retain that level of expertise. Attackers understand that imbalance.

The Sustainable Answer Is Preparation

If paying isn’t the answer, what is? Preparation.

Every organization should have a documented and practiced incident response plan. External cyber counsel should be identified in advance. An experienced incident response team should be on retainer, even if the retainer itself is minimal. Offline or immutable backups should be in place. Leadership teams should participate in realistic tabletop exercises that simulate extortion scenarios and force difficult communication decisions.

Those exercises should create pressure in a controlled environment so leaders can think clearly before a real crisis hits. The first time you practice responding to ransomware should not be when it’s happening.

Recovery from an incident should take days, not weeks. Root cause analysis must be thorough. After containment, the focus should shift to hardening the environment, eliminating tech debt and strengthening resilience. Cybersecurity is not a destination you arrive at. It’s an ever-evolving journey.

Resilience Over Ransom

I understand why companies pay. I’ve sat in those rooms. I’ve watched leaders wrestle with the question, “Wouldn’t it be easier if we just paid it?”

But easier isn’t the same as smarter.

Paying increases the likelihood of being attacked again. It rarely resolves systemic vulnerabilities. It can create legal, insurance and reputational complications. And it fuels a criminal economy that makes all of us less secure.

Don’t pay the ransom. Be prepared so you don’t have to.

This article was originally published by the Forbes Business Council.