What changed, and what it cost¶

Every operational action changes two independent states simultaneously: the structure of the environment and the defender’s evidence about it. One governs what becomes reachable, the other what becomes observable. Structural changes accumulate whether or not they generate alerts, while evidence accumulates whether or not defenders immediately act upon it.

A position one hop from domain administration may make directory service synchronisation possible, potentially generating Windows security events such as 4624 or 4672 alongside endpoint detection and response alerts where those controls are present. Industrial logic access may permit downloading of control routines while leaving an off-hours session logged and programmable logic controllers in programming mode, occasionally affecting cycle times or triggering vendor escalations. Cloud data lakes may become readable and temporary credentials recoverable while potentially leaving CloudTrail events, GuardDuty findings where enabled, configuration drift, or unapproved snapshots. Remote code execution on web application hosts or direct database access may generate web application firewall hits where deployed, unusual error rates, invalidated sessions, or rate limiting.

Defenders reconstruct operations from accumulated evidence rather than direct observation. Log telemetry, alerts, configuration changes, and ticket management systems form an operational model that exerts counter-pressure through investigation and response. The resulting costs emerge at different speeds. Event records answer immediately whether an action was observed. Structural changes unfold independently through mechanisms such as lockout counters incrementing towards thresholds, credentials expiring, sessions timing out, or configuration drift altering future opportunities. Human response arrives more slowly through credential rotation, host isolation, incident response, key revocation, or blocking rules. A failed authentication attempt immediately creates an event record, increments any applicable lockout counters, and may later contribute to analyst investigation when viewed alongside other activity.

It is not only about whether an action was detected. Every operation leaves two legacies: a changed environment and a changed body of evidence. Either can outlast the operation itself, and together they define the position from which both attacker and defender continue. Where the observer is a classifier rather than an analyst, the evidence can be shaped directly, at inference time or in the training data.

Price the move in Revising, then pricing, map what it opened, or decide the position already has enough value.