When sensitive data is stolen during a computer intrusion, negotiations can quickly become public and ransom demands increase dramatically. Law firms that have non-public information about clients are especially at risk. The strongest position to be in is to keep detailed logs of computer activity and monitor systems 24-hours a day to quickly detect and stop intrusions before the attackers have the time to find and steal large quantities of data. If a company has detailed logs to investigate, it can be determined how much access the attackers had and what files they may have stolen. That knowledge can help with negotiations, since the victim company will know whether the data the attackers claim to have access to was actually at risk or not.