Excellent article, Rich! I was particularly struck that Cisco IT can identify and contain AMTs in 17 hours compared to 200 hours for many companies. Regarding your point 1, here's a nice companion article about the partnership between Cisco IT and InfoSec: http://www.cisco.com/c/en/us/solutions/collateral/enterprise/cisco-on-cisco/cs-sec-03232016-operational-security.html