"Microsoft recommends that enterprises use a split-tunneling VPN for cloud-based traffic for both Defender for Endpoint and Defender Antivirus." Breathtaking.

"Microsoft recommends that enterprises use a split-tunneling VPN for cloud-based traffic for both Defender for Endpoint and Defender Antivirus." Breathtaking. Just double the complexity of the host networking, opening up all-new attack services, so our IPS can phone home! It's a shame that Defender for Endpoint is really the only game in town, but if anyone is looking for a massive untapped market, a competent runtime security daemon would sell. White House cybersecurity EOs and current DISA guidance mandate such tools, and almost none of them run on Linux. Those that do focus on kubernetes security or the like; there are almost no options for bare-metal Linux.