Differentiate your defensive strategies between external and internal threats. It is much less expensive to extend your security umbrella to staff smartphones, laptops, tablets and home (even kid's computers) than it is to resolve a penetration.

Remember that it does not stop with 'paying the ransom', especially small, sub $5,000 ransoms. The entry points to your system are sold on the darknet. You must find the penetration point, close it, and take effective remedial action which includes extending the security umbrella, staff training, regular audits and tentesting.