In my time in IT I got to see and stop mid-stream malware encrypting files for ransomware and data exfiltration. Those exciting times are now in the rear view mirror for me. But with Patelco's ransomware incident and the advances in AI, it got me thinking that surely if I - a mere mortal - could see these processes happening and shut them down (disable NIC for example) - then surely an AI bot could do a much better job of this. There must be recognizable patterns that would permit some kind of protective turtle posture to be undertaken on first detection of an unusual number of files being encrypted, becoming unreadable or some other flag like that. What's been going on in that front?