Organisations ought to draw and baseline their edge tool traffic, especially VPN and far away entry connections, and undertake dynamic threat feed filtering that entails known covert community indicators.