Could you elaborate on where you see the hardening taking place? Colonial had a threat actor in their network and by paying the ransom, they supposedly left without doing any more damage. I don’t think they patched a lot of systems or hardened their servers.