Ransomware keeps getting treated like a business risk, but it's basically a hostile act against critical infrastructure. We're stuck in a loop of paying ransoms and hoping for the best, which just funds the next attack. Mandatory incident reporting would at least give us a real picture of the threat, and we need offensive countermeasures to hit back, not just insurance payouts that make the problem worse. Stop calling it a cybercrime and start calling it what it is: a national security failure we're paying for twice.