While reading this, I couldn't help but wonder what SaaS vendors like AWS (RDS) do to protect themselves from inevitable RCE that provides a shell to an attacker. Sooner or later someone is going to get a shell. Do they use virtualization in a way where rooting a machine doesn't give much of a foothold into the network?