these things are why focus on assuming compromise should be the default. Stop focusing all the effort on identifying the exploit instead focus on the behaviour of the attacker after exploit.