Or there's some exploit in an endpoint device, and the problem moves laterally from inside your firewall.