@patrickcmiller I always suspect post incident make-over responses. They almost always result in too quick a response that misses basic stuff, leading to more vulnerabilities.