Progress is being made, but too many network devices still remain difficult to investigate after compromise