Can you give some examples for the claim that most of the attacks don't make it upstream? My gut tells me that, yes, mostly binaries have been compromised. But I am sure you have some real-world examples proving the point.