There was a time when Linux meant server rooms and hobbyist forums. These days it's on regular laptops, and a big part of that is people getting fed up with commercial operating systems scraping their data, shipping telemetry nobody asked for, and bo...

There's a gap between what Linux systems log by default and what you actually need to detect a compromise. Most environments have logging active, which creates a sense of coverage that doesn't hold up under investigation.