Security via obscurity and "closed loop" tends to be the answer, plus whatever doesn't show up on a scan tool.

Thankfully we have a (fairly) accessible API to the cloud side.

TBD on what (if anything) matter will change.