Two maps to redraw¶

The terrain map updates as a matter of course. Every move produces hard facts, and facts form its foundation. The second map is the one teams regularly skip: a model of what defenders now see, updated from the exact same evidence.

The terrain side¶

A move resolves known gaps while creating new ones. A pivot redraws reachability from a fresh vantage point, adding edges and occasionally removing them, given that a new position may reach less than the previous one in an unexamined direction. Acquiring an identity changes privilege relationships across the environment, and not just for the credential itself: group membership discovered along the way frequently outweighs the token that revealed it.

Negative results require recording just as meticulously as new paths. A route that proves non-existent, a share that turns out empty, or a domain controller that fails to answer: each represents a concrete fact, and each is costly to rediscover later.

The keepers’ side¶

The second map tracks defender visibility, constructed from the same actions viewed through their lens. A successful authentication creates a log line stamped with a source IP address. A locked account creates a helpdesk ticket queued for Monday morning. A rotated credential signals an event-driven response rather than a scheduled task, provided the baseline schedule is known. A domain controller flagging a mode change generates an alert on a SOC analyst screen.

Direct observation catches some of this, such as when access abruptly stops without explanation. The majority requires inference based on how the environment reacts next. This leaves defender visibility as the map held with the lowest confidence, yet it remains the most critical to maintain.

Two thresholds to carry¶

Positioned alongside both maps are the specific thresholds any subsequent move will cross, turning passive record-keeping into operational decisions. A lockout counter with two attempts remaining. An egress volume that remains unremarkable until a bulk data extraction occurs. A maintenance window closing at six, after which any session on the industrial network becomes anomalous by definition. None of these constitutes a pure fact about the infrastructure or the defenders; each defines the exact operational cost of the next action, enabling accurate risk pricing.

Keeping the two apart¶

Blending these two views into one score is easy and counterproductive. A move that expands reach while exposing activity represents progress on the terrain map and damage on the defender visibility map. A single combined metric conceals this trade-off rather than resolving it. Maintaining two distinct maps ensures the operational team can address both sides of the next decision: what an action opens, and what that action costs.