>Literally solved with a DMZ around these agents. Want to get fancy? Put in a firewall and some metrics around traffic / domains with alerting.

Now how many people actually do this, compared to people running with --dangerously-skip-permissions on a bare metal machine?