Assumed compromise · Objective-based lateral movement · Live trace
When the attacker gets inside
Destroy production infrastructure from a single assumed foothold
↑ history
↓ forward
space skip
r replay