Research: Half of businesses now have a policy on whether to pay out on ransomware