Building a ransomware decision tree before the call comes in | CyberBlackmail