Writing

Measuring how fast memory changes, when the kernel will only tell you whether it changed. A page-frequency instrument, its validation against known workloads, and the negative result that separates it from symbol profiling.

Attackers need one path to work. Defenders need every path closed. Automation was supposed to help the side with more work to do — so far it has helped the side with less. The exception is detection: the attacking agent has to run its loop on your ground.