Yes, but backdoors/malware are a different question. I was talking about authorized access - LDAP, ssh keys, etc. Detecting unauthorized software from a rogue

Yes, but backdoors/malware are a different question. I was talking about authorized access - LDAP, ssh keys, etc. Detecting unauthorized software from a rogue privileged user is a different problem with very different mitigations. It is a great topic that I'm personally interested in, given that I'm implementing controls for that, but I wasn't discussing that.