Determining accurately if we can safely scale down an instance is one of the hardest things we do, I can not think of a way to determine this in an automated fashion.
love the release, ive tried roame a couple of tiems, its hard as a non US card holder sometimes to see all those sweet deals roll by. Keep up the good work team!
Crowdstrike and other tools that have this access is for them to update their agents so that in case they see a ransomware or attack pattern to push it out to as many devices as possible to stem the attack. Do you need all this crazy level of kernel access, probably not, I hope they will have some refactoring efforts in the future.