No need to "ask" for "proof". You can monitor the system in real-time and detect malicious or potentially harmful activity and stop it early. The same tools and methodologies used by security tools for decades...