A very interesting article indeed, I didn’t manage to read all of it yet. Is there any conclusion why EDR was not sufficient? Was it due to inconsistent rollout of the edr agent, are there detection gaps on Linux or where the TTPs just out of scope for an edr?