Great breakdown of both the strengths and limitations. The collector becoming a high-value target and the ongoing maintenance required to bridge the semantic gap are points that often get overlooked in discussions about VMI.

I'm particularly interested in seeing the performance benchmarks and real attack simulations from your upcoming lab testing. It would be valuable to compare the visibility gained through VMI against traditional EDR approaches in environments where agents aren't an option.