QoS throttling is the annoying practical trick here, not another firewall block list. The author shows Elastic Defend losing server contact after per-process policies pin common EDR binaries to 8 bits per second, which is the kind of demo where the missing operational question is who notices the policy before the dashboard goes quiet.