The Insider’s Playbook for External Threats: Detection and Disruption Across the Public Attack Surface