> That's not sufficient evidence.

Then your standards of evidence are too high, and least for making decisions in this area. It's like you're working in computer security, but you demand evidence a vulnerable system was actually hacked and used maliciously before you're willing to take action to patch it and clear out the infiltration. It's foolish. Patch the damn system.