Something tells me that wouldn’t make a huge difference in some of these companies opsec.

I’m pretty sure they already do, especially endpoints open to the whole internet that are unauthenticated.

If only there was a rule saying "don't do that, this would not have happened