I believe that forensics of major attacks does show that usually the bad guys have been in the network for weeks before triggering the ransomware, and it rarely

I believe that forensics of major attacks does show that usually the bad guys have been in the network for weeks before triggering the ransomware, and it rarely happens on the same day as the initial attack. The expectation is that they will first spend the time and effort to look at your network to find out your backup process, and do/wait as much as is necessary to circumvent, disable or destroy your backups if it can be easily done.