I wonder if CBT could be used as a "security utility" -- like ProcMon, "telling user" live and/or in a daily log if certain files that should not have been updated or changed were indeed changed. It's within the licensed versions - maybe put it to good use?

"Take care of thy backups and thy restores shall take care of thee."  Ben Franklin revisited.