To your final question, those machines were likely to have a connection to the internet at some point or indirectly through something else, of which may have le

To your final question, those machines were likely to have a connection to the internet at some point or indirectly through something else, of which may have left it vulnerable. It speaks to more than just EDR solutions but appropriate segmentation of critical endpoints on the network. Flight status displays may have definitely had an internet connection. To your middle point, I don't think perhaps people understood the reality of how/if Crowdstrike would become a single point of failure on their systems. We now know it was a single point of failure that caused systems to completely shutdown, but up until that point I don't think that potential was overly understood nor considered how possible it was going to be.