Instructure struck a deal to recover its stolen data -- likely paying a hefty ransom. For CISOs, deciding whether to negotiate with cybercriminals should come down to business risk.