Evaluating operational gains¶

Evaluating what a move achieves requires separating genuine capability from mere momentum. Gaining an access path grants a specific ability to perform a defined action, held by a designated identity, from an explicit network position.

Stating gains as precise capabilities¶

Concrete capabilities depend on the underlying terrain:

In an enterprise network, acquiring directory replication permissions provides raw password hashes without requiring interactive logons. On an operational technology network, reaching an industrial controller allows reading or modifying program logic during an upcoming maintenance window. In cloud environments, access can yield read capability over a data lake alongside a role delegation function, each governed by separate timeframes such as a six-hour session ceiling or an open trust policy. Within web applications, obtaining execution access offers host-level command execution alongside direct database querying.

Documenting gains with explicit expiry times and technical boundaries keeps operational assessments grounded in facts rather than vague feelings of progress.

Distinguishing capability from execution¶

Holding a capability differs from exercising it, and treating potential access as already consumed leads to faulty planning. Possessing directory replication rights is not the same as actively pulling credential hashes, as executing the action leaves entries in event logs. Unexercised capabilities, particularly loud ones whose strategic value does not decay over time, are often worth holding in reserve.

Documenting negative outcomes provides equal value. Confirming that a network segment is firewalled, a credential scope is narrower than expected, or a controller rejects a command records an essential constraint. Negative results are cheap to lose and expensive to rediscover, as subsequent planning easily defaults to unverified assumptions if findings go unrecorded.

Measuring progress through option expansion¶

A meaningful metric for forward progress is the number of viable next moves created rather than the headline severity of a compromised asset. Where a specific target is not pre-assigned, obtaining credentials that reach four secondary hosts provides greater operational flexibility than gaining access to a single higher-value host with no further egress.

Option expansion tests whether a position justifies its acquisition cost. A move yielding a high-profile capability without increasing forward options produces an impressive line in a report rather than an actionable advantage on the network graph.