Without isolated, immutable and strictly controlled backups, 84.5 percent of attacked companies do not pay ransom and still recover, while paying companies fail 8–33 percent of the time and face additional insurance and sanctions risks.