The CEO forwarded a breach story with the subject line "us?". Here is the answer that takes one afternoon: every laptop covered, with no proxy, no MITM certificate, and no network change. Push it through the MDM you already run and the first sweep lands within 24 hours.