Companies these days just “contract external security consultant” for exact amount of ransom + fees aka ask the perp for a receipt for tax purposes