There exist a few products targeted at enterprises that attempt to detect suspicious patterns of encrypting files at the OS and/or backup level and flag that if

There exist a few products targeted at enterprises that attempt to detect suspicious patterns of encrypting files at the OS and/or backup level and flag that if it happens. I wouldn't describe that as the "best" defense though, it's an "earlier warning system" but not early enough to prevent damage. You've already been hacked, the criminals have already exfiltrated all the data they can, have already installed whatever backdoors they are going to, and have even already started preventing you from accessing some of your own data. (That doesn't mean earlier warning doesn't help, and it's probably worthwhile, but it's a component in a broader last line of defense system that you never want to use in the first place). The best defense is not getting hacked in the first place, and not letting malware spread when you do. If you are a big enough target that the "detect ransomware" solutions are remotely affordable you should hire some experts on this topic, but think about things like good phishing training, good firewalls, good software engineering, keeping everything entirely up to date, and so on and so forth. Backups help (a lot!) but are not the cure all that people like to pretend they are. Apart from all the other damage hackers do apart from deleting things, hackers do attempt to delete backups too, and sometimes they succeed. (Disclaimer: I use to work on one of these products)