These tools must be able to identify patterns where companies’ shares are shorted before a high-profile ransomware attack, to identify those seeking to benefit from these crimes.