What is covered
- External attack surface validation and exposed services
- Internal segmentation, trust boundaries, and reachable management services
- Credential abuse, default paths, and privilege escalation
- Lateral movement opportunities across hosts, shares, and identity controls
- Misconfigurations that undermine detection or resilience