Paying ransoms should be a criminal offense. Even if the victim company would end up bankrupt that would be an acceptable outcome to keep money out of the hands to criminals.
Cybersecurity spending is a black hole sucking in immense amounts of money while achieving no useful defense against typical threat actors such as organized crime who routinely target these companies. The current large vendors are all peddling snake oil and there is no value to purchasing it to cure what ails you.
The only correct assessment at this time is assuming you are 100% guaranteed to be hacked by organized crime if you are internet connected. You can then work from there to determine how your operations should be structured. Alternatively, you could demand your vendors take on liability for their security guarantees. They will not, but it will help you smoke out the snakes.