The core message of the session is that earlier detection of phishing and ransomware-related activity depends on turning large, noisy cybercrime supply-chain data into actionable intelligence. The speakers frame the work as a public-private and research-driven effort involving Delft University, TNO, CFLW, law enforcement partners, and prosecution authorities. Rather than focusing only on individual attacks, they emphasize the surrounding criminal ecosystem: credential theft, resale of valuable access, ransomware groups, cash-out mechanisms, and the need to identify meaningful signals before harms escalate. The stated challenge is a “needle in the haystack” problem: data volume is not the bottleneck, but detecting the right signals and knowing how to act on them is.