Right, but part of the appeal of tools like crowd strike and sentinelone is that they can stop them when they're in ring 0. And rollback changes. Etc.