The containment paradox: Why your ransomware playbook has the wrong people in charge

I have sat in on a version of the same incident post-mortem in three sectors over the past two years. The script does not vary much.