Where instances / VMs are deployed, do not preclude the use of operator-provided endpoint detection & response software installed on the nodes.