Ransomware attacks typically encrypt files on a workstation, potentially delete backups across network shares, copy sensitive data for extortion threats, and then demand payment to decrypt—the attack vector requires endpoint-level capabilities that network monitoring alone cannot detect