Got it. The way it was phrased it made it sound like Assetnote was the party actually sending the exploits (which made me assume it was intentional testing going to the wrong target), not that they were coming in from unknown senders in the outside world.

nope, it really is assetnote's intentional testing going to the wrong target