A SOC analyst is investigating malicious traffic seen leaving the corporate network toward a known command-and-control server. The perimeter firewall logs show the source of all outbound sessions as a single public IP address, 203.0.113.10, which is the outside interface of the border device. The analyst cannot determine which of the hundreds of internal workstations actually generated the traffic. What is the primary data visibility challenge causing this problem?