Today’s threat picture centers on compromised control planes: RMM, build servers, package publishing, water controllers, network management, and backup consoles. The common question is not only what was patched, but what trust boundary may already have been crossed.