A computing system comprising: a computing device including: at least one processing element ; memory ; firmware engines implemented as executable firmware instructions, the firmware engines including: a baseboard management controller, BMC, separate from the at least one processing element to provide at least one out of band service for the computing device; wherein the BMC is configured to: provide a storage drive as a virtual drive to an operating system executing on a central processing element, wherein the storage drive is configured to act as a honeypot and includes mimic master boot partition data and other data, wherein the storage drive is thinly provisioned to appear to have more capacity than actually available; monitor the storage drive to determine that there is an indication that ransomware is present on the computing device based on an activity pattern that includes modification to the mimic master boot partition data; and perform a security action in response to the indication that ransomware is present on the computing device. at least one processing element ; memory ; firmware engines implemented as executable firmware instructions, the firmware engines including: a baseboard management controller, BMC, separate from the at least one processing element to provide at least one out of band service for the computing device; wherein the BMC is configured to: provide a storage drive as a virtual drive to an operating system executing on a central processing element, wherein the storage drive is configured to act as a honeypot and includes mimic master boot partition data and other data, wherein the storage drive is thinly provisioned to appear to have more capacity than actually available; monitor the storage drive to determine that there is an indication that ransomware is present on the computing device based on an activity pattern that includes modification to the mimic master boot partition data; and perform a security action in response to the indication that ransomware is present on the computing device. a baseboard management controller, BMC, separate from the at least one processing element to provide at least one out of band service for the computing device; wherein the BMC is configured to: provide a storage drive as a virtual drive to an operating system executing on a central processing element, wherein the storage drive is configured to act as a honeypot and includes mimic master boot partition data and other data, wherein the storage drive is thinly provisioned to appear to have more capacity than actually available; monitor the storage drive to determine that there is an indication that ransomware is present on the computing device based on an activity pattern that includes modification to the mimic master boot partition data; and perform a security action in response to the indication that ransomware is present on the computing device. provide a storage drive as a virtual drive to an operating system executing on a central processing element, wherein the storage drive is configured to act as a honeypot and includes mimic master boot partition data and other data, wherein the storage drive is thinly provisioned to appear to have more capacity than actually available; monitor the storage drive to determine that there is an indication that ransomware is present on the computing device based on an activity pattern that includes modification to the mimic master boot partition data; and perform a security action in response to the indication that ransomware is present on the computing device. <EOS>