With payment bans spreading across jurisdictions and the data showing that paying buys neither safety nor silence, security leaders are confronting a harder question than whether to pay: how they became the target in the first place, and whether they can recover without negotiating at all.