I need more context: do you scan inbound uploads to your servers/website? and is it a public upload portal?

SES is what I use as a prescriptive security measure to discourage brute force attacks on Windows and Mac devices. P2P control:https://techdocs.broadcom.com/...

@Clement Johnson No sir, HIPS and HFW are not cumbersome to manage, and PnP solutions are most common way you get Compromised, PNP then gives you have an excuse to blame someone else secret sauces for felling you and your business, exposing your business to extortion, and…

SEP/SES and its firewall have a feature to stop this: 1. Use location-aware FW rules and policy with allowed access lists to only jump servers. 2.  Enable SEP/SES P2P enforcement - Peer-to-Peer Authentication Settings (broadcom.com).

I my opinion Application and browser isolation is the future, and crucial to properly layering protections again email threats born in phishing attacks.