If a device starts acting strangely — accessing files it shouldn’t, running unusual processes — we flag it immediately.
