While 2 is possible, we've had automated ransomware going for some time now. The agents in 1 are sufficient.