The latest cyberattack, apparently emanating from Russia again, has hit at least 20 software firms affecting at least 1,000 businesses.

It follows a cyberattack that left parts of the U.S. without adequate gasoline supplies for several days and one on the Irish public health system. There are undoubtedly many more attacks that go unreported, if only because the victims do not wish to advertise their willingness to pay ransom.

And so the obvious question arises: How is all this supposed to stop? For an answer, it’s useful to apply some game theory.