> How do you message this effectively? Assuming the entire org is using a captive proxy with an installed CA, identify/isolate every upper-level management per

> How do you message this effectively? Assuming the entire org is using a captive proxy with an installed CA, identify/isolate every upper-level management person's system(s) in some way, and reroute their access to all internal applications through a deliberately horribly misconfigured HTTPS reverse proxy running TLS 1.0. Their modern browser will explode. "AAAA, sorry, that thing we've been telling you about for months hit us earlier than we thought it would but thankfully it's only hit all the internal stuff" "Wait so this is what all of our customers will see?" "Yes, all of them. Nobody will be to reach us, none of our APIs will work, and we will also break our SLAs on every single contract." --- You probably want to use GPO to disable bypassing the security warning prompt, and/or set up HSTS for your domains beforehand.