What do we do about all the credentials that have been

leaked? Well, let me step back.

If the assessment shows that there's an indication, if there is persistence, we do not have the creeps out yet.

So at that point, if there's an indication that the persistence there, then it would warrant a further assessment.

threat hunting investigation, and then remediation.

So once the persistence is discovered, then there's effort to remediate it.

So in the case of rogue domain administrator accounts, then to clean those up.

Is there anything else you want the audience to know about this?