I'm not sure what you mean by Step 1, however what you're suggesting is more akin to an engineer at a SaaS provider carrying out maintenance or debugging a faul

I'm not sure what you mean by Step 1, however what you're suggesting is more akin to an engineer at a SaaS provider carrying out maintenance or debugging a fault and stumbling across something suspicious. What's being suggesting is active monitoring of every communication.