It is also important that we ask the right questions. Unfortunately, a lot of the reporting in the mainstream media have uncritically borrowed descriptions that belong to nuclear apocalypse and viral outbreaks to describe WannaCry - focusing on "pandemic" symptoms. This reporting seems to only reinforce the popular public understanding that the solution is buying some AV product or implementing some expensive security solution from a security vendor. 

(1) Why is the NHS running out-dated and no longer supported Windows? Where is cricitism of their IT policy?
(2) Why are people not using the plethora of proactive tools? Or in this case updating patches and backing up data? This gives us insight into user preferences and what security solutions might be more effective. 
(3) Why did they only make a modest amount of money? Advanced users too secure, noobs that don't understand Bitcoin transactions?
(4) Zero-days in the hands of governments and their disclosure and vendor patching?