"He added that Mimecast research showed around half of all ransomware victims paid up."
We shouldn't be surprised by this
Organisations, or more precisely, the lumps of flesh shaped like humans who lead these organisations, they like money.
They simply see it as an operational cost that "might" occur, whereas paying for cyber compliancy training and or a sufficiently staffed IT ship, is a cost that is guaranteed.
Business people are the worst people to be making these kinds of decisions