Four choices following risk evaluation¶

Risk pricing produces operational choices rather than rigid commands, offering four distinct pathways. Engagements spend significant time evaluating these choices, selecting one pathway, and returning to the same decision framework after subsequent actions.

Expanding environmental mapping¶

Gathering additional intelligence represents the most common option, though it often feels like static activity. Teams select this path when the network graph remains incomplete, identity pathways depend on unverified group memberships, or suspected technical dependencies require confirmation. Expanding environmental mapping consumes minimal operational footprint while proceeding slowly, which tempts teams to skip reconnaissance in favour of aggressive lateral movement into unfamiliar segments.

Extending network reach¶

Pivoting into secondary systems expands operational reach without immediately collecting target data. Teams select this option when current mapping is sufficient but existing vantage points restrict direct access to target systems. Establishing an additional pivot host increases operational footprint compared to passive mapping, trading visibility for expanded target access.

Executing primary data collection¶

Executing target collection appears to represent the primary objective, yet it rarely constitutes the immediate next step. Teams select this path when mapping confirms target access, risk evaluations verify that generated telemetry remains acceptable, and persistent egress paths remain established. Initiating collection prematurely often forces secondary extraction attempts, as initial pulls reveal missing data requirements on a network where defenders have begun investigating anomalies.

Terminating active operations¶

Terminating active movement skips intermediate steps to compare collected assets directly against engagement objectives. Teams select this option when risk evaluations indicate compromised positions, elevated defender awareness, or exhausted operational thresholds.

Recognising common decision failures¶

Pursuing maximum target value on every turn creates high network visibility, accelerating defender detection and forcing early engagement termination.

Conducting endless mapping avoids operational risk, as teams continuously seek complete network graphs until engagement timelines expire without achieving core objectives. Evaluating operational footprint and maintaining accurate visibility maps ensures teams select pathways deliberately rather than defaulting to habit.