Detect ransomware staging before encryption using identity, endpoint and backup signals to catch credential abuse, lateral movement and tampering early.