My big take-away is not that "all these systems shouldn't be connected to the internet", it's a few other things: 1. These systems shouldn't allow outbound net

My big take-away is not that "all these systems shouldn't be connected to the internet", it's a few other things: 1. These systems shouldn't allow outbound network flows. That will stop all auto-updates, which you can then manage via internal distribution channels. 2. Even without that, you can disable auto-updates on many enterprise software products - Windows notably, but also Crowdstrike itself. I heard about CS customers disabling auto-update and doing manual rollouts who were saved by this practice. 3. Tacking on to number 2 - gradual rollout of updates which you've done some smoke testing on. Just in case. Again - I heard of CS customers who did a gradual rollout, and managed to only have a fraction of their machines impacted.