The industry is pretty bad at blocking RCEs (0-day is just inevitable, but preventing 1-day or just stolen credentials is IMO equally hard). The industry is bet

The industry is pretty bad at blocking RCEs (0-day is just inevitable, but preventing 1-day or just stolen credentials is IMO equally hard). The industry is better at detecting compromise by spotting post-exploitation behaviors such as reverse shells or exfiltrating large amount of data. Your developer uses VSCode and sends a lot of data to vscode.dev or another Microsoft domain? Sounds totally normal, nothing suspicious here, move on!