The threat landscape has changed.
The question has changed with it.

Communication Governance stops it: Credential exfil and C2 calls blocked at workload boundary — novel exfil domains denied before any IOC exists.

Communication Governance stops the playbook: The credential-harvesting-to-lateral-movement pattern requires workload-to-workload reach. Default-deny east-west policy closes that path regardless of credential validity the same architectural control that applies to Storm-0501 and TeamPCP. Scope: CG enforcement applies at the cloud workload layer. Salt Typhoon's documented persistence on network device firmware (Cisco IOS XE) operates below this layer and requires separate network device hardening. CG contains the cloud-side impact once attacker tooling attempts cloud workload-to-workload movement or C2 egress from cloud environments.

Communication Governance stops it: C2 communication and lateral movement paths blocked. Ransomware deployment requires workload-to-workload reach that default-deny east-west denies.

Communication Governance stops it: The IdP credential grants authentication — it does not grant network reach. Workload-level east-west policy is enforced independently of IdP state. A compromised Okta admin session cannot pivot to workloads, databases, or internal APIs not explicitly permitted for that source. The Blast Radius is bounded before the first internal move.

Communication Governance stops it: The Azure Service Principal grants cloud identity — it does not grant network reachability. Workload-level east-west policy enforced by Aviatrix is independent of Azure RBAC and Service Principal scope. A compromised Service Principal cannot pivot to workloads, databases, or internal APIs not explicitly permitted for that source identity at the network layer. The blast radius is bounded at the cloud firewall before the first cross-tenant move.

Communication Governance stops it: GOLDTOMB requires outbound C2 connectivity to beacon and receive tasking. Default-deny egress blocks the callback before any data leaves the Oracle EBS workload — no IOC, no signature, and no behavioral alert needed. The silent weeks-long exfiltration phase that precedes CLOP extortion demands requires sustained outbound data transfer to attacker-controlled cloud storage; without an egress path, the exfiltration cannot complete and the extortion leverage never materializes.

Communication Governance stops it: A contractor account that looks legitimate at the identity layer is still subject to network-layer policy. Communication Governance scopes what the contractor workload can reach — limiting access to exactly the services required for the stated role and blocking lateral movement to data stores outside that scope. Anomalous egress (bulk data transfer to personal cloud storage, access to production databases from a contractor sandbox) is blocked before exfiltration volume reaches extortion threshold. The 122-day dwell problem is a detection problem; CG makes it a containment problem instead. Note: CG limits the blast radius of any provisioned identity — data stores and workloads not explicitly permitted for that source remain unreachable. CG does not eliminate insider risk, but it constrains the architectural surface a compromised or malicious insider can reach, regardless of credential legitimacy.

Communication Governance stops it: The OAuth token exfiltration and C2 callbacks are blocked at the workload boundary before any credential leaves the environment. Third-party AI tool access to internal systems is governed at egress — even a compromised OAuth app cannot reach credential stores when workload-level east-west controls are enforced.