Yep. Assume one or more layers are pwned and rootkitted, especially if it runs Linux because the attack surface is huge in most distros. Never fall for the brag

Yep. Assume one or more layers are pwned and rootkitted, especially if it runs Linux because the attack surface is huge in most distros. Never fall for the braggadocio of arrogant, lazy MAANG employees who blindly declare the infra to be "secure" without evidence. Where possible, run a transparent proxy/scrubbing/NIDS/NIPS network layer running OpenBSD or similar. Log setup using WORM media, log structured fs, and/or blockchain would be ideal.