How much time do we have once ransomware starts touching file shares?
Very little: often minutes to hours, depending on how much data there is and how many machines encrypt at once. When encryption starts, one or several clients read and rewrite large amounts of data on network shares in a short time, and users begin to find files they cannot open. At that point containment comes first: disconnect the hosts doing the encrypting, take the affected shares offline or make them read-only, and protect the backup server by cutting its network access if needed. Decide in advance who may do this without asking. The real window is earlier, in the days of beaconing, scanning and lateral movement before encryption. NetSenX has no dedicated detection for the encryption step itself; it watches those earlier steps on every plan, Free included.