An attacker’s blunder gave us a look into their operations

I don't understand how "we actively spy on our customers and blog about it" is a viable marketing strategy..?

The cybersecurity industry is dominated by companies who sell this as their "cyber threat intelligence" and "real-time protection" special sauce.

Presumably this

> We knew this was an adversary, rather than a legitimate user, based on several telling clues. The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent.

So in any other context, they probably wouldn't do any digging into the machine or user history, but they did this time because they already had high confidence of malicious use from this endpoint.