If an attacker can retrieve the API and libraries, then use these to write an agent, and then get the attack

 If an attacker can retrieve the API and libraries, then use these to write an agent, and then get the attacker’s agent installed, how should Digital Diskus protect itself from such an attack? Should the business analytics system provide a method of authentication of valid agents in order to protect against a malicious one? Is the agent a worthy attack surface?  500 words 

 Consider the data flow “octopus,”. How can the analysis system gather data from all these sources that, presumably, are protected themselves? 300 words