So many companies are set up to fail when it comes to ransomware. One of the key ingredients to ransomware attacks is to make split-second decisions. At my job, it's not uncommon for me to get hounded for updates from multiple people about multiple different issues across multiple platforms. It's also not uncommon for me to get e-mail notices that I'm overdue on a training (I am approaching 700 days overdue for one. I'm very excited about this milestone!). To the point... Companies create a culture of split-second decision making and then they spam your e-mail with a bunch of additional shit. "Hey do you still need these privileges?" "Hey did you set up your print pass?" "Hey this mandatory training is a day over due." The natural reaction to having a ton of work to do plus a ton of trivial shit creates an attitude of "UGH! I guess I'll just get this thing over with now so they stop bothering me about it! FUCK!"