Value relative to operational footprint¶

Prioritising candidate moves solely by raw objective value leads to poor strategic choices. The action that yields the broadest access often generates the most obvious telemetry, causing a plan that pursues maximum immediate value to exhaust its operational exposure during initial execution.

The multiple dimensions of footprint¶

Footprint metrics cannot be reduced to a single aggregate score without obscuring critical trade-offs:

• Network visibility represents wire-level sensor records, including connections to unmapped hosts, volume anomalies outside baseline hours, and unauthorised protocols on restricted segments.

• Account visibility covers identity-layer events, such as authentications from novel IP addresses, service accounts executing interactive user sessions, or session tokens presented across geographically distant regions.

• Operational disruption measures the risk of causing system failure, which represents an inconvenience in corporate environments and a critical safety hazard on industrial control networks.

• Defender attention is consumed whenever activity prompts human analysis, and once drawn to an environment, defensive scrutiny remains elevated.

• Forensic residue consists of persistent artefacts left for post-incident reconstruction, creating long-term risks that endure well after operational activity concludes.

A move can remain cheap across four dimensions while proving fatal on the fifth. For example, querying industrial controller data points produces zero identity alerts and negligible network traffic, yet it can lengthen controller scan cycles enough for a plant operator to notice performance shifts on a local display.

Evaluating operational trade-offs¶

When priced accurately, competing candidate moves rarely present equal risk profiles. A domain-wide Active Directory query that resolves six unknown systems while triggering a high-severity SOC alert compares unfavourably against a slower, targeted query that resolves two systems silently. The quieter option offers superior value because the remaining four target systems remain available for discovery later, whereas the generated alert permanently alters defensive posture.

Conversely, executing high-visibility actions becomes a deliberate choice under specific operational conditions: when time windows are expiring, when the primary objective sits within immediate reach alongside a planned exit, or when generating noise on one segment distracts defenders from quiet activity elsewhere. Reading the operational cost beforehand distinguishes strategic execution from an unforced error.

Defining the operational currency¶

The true currency being expended is not the raw count of log entries generated. It is the finite number of unmonitored moves remaining before defensive teams initiate active response. That threshold remains unknown, requires continuous reassessment after every interaction, and varies across different environments. As a result, assessing footprint requires operational judgement rather than simple arithmetic, which is why an identical move carries a different cost on a Tuesday morning than on a Friday night.