Patching the exploited service can leave a perfectly functional way back in: stolen credentials or remote-access software. The responder closing the host ticket may not own either.
CISA’s new Integrity Tech advisory makes that distinction worth revisiting. It describes a China-linked company enabling scanning, credential attacks, persistence, and collection; DOJ alleges its tools supplied capabilities to clients. That supports an enabling model, not attribution of every similar intrusion.
The governance question is who can require cross-team eviction checks before recovery is declared. Otherwise, every team can finish its assigned fix while nobody answers the combined question. AlphaHunt examines that ownership decision and its tradeoffs:
Read the game theory analysis.