If these agents are running locally, aren't they likely to be fooled (or even directly targeted) by rootkits? I can see they might be able to watch a user compr

If these agents are running locally, aren't they likely to be fooled (or even directly targeted) by rootkits? I can see they might be able to watch a user compromise the machine, though, depending.