Automated containment and response authority

Unit 42's ten-hour intrusion forces a choice about who may disable an account without asking

Palo Alto Networks estimates the same work would have taken human operators roughly two weeks. The pressure that creates lands less on the threat model than on the contract saying who may act at 3am.