One Proxmox host split into isolated, separately-firewalled networks, with a SIEM watching all of it and backups a compromised host can't erase.