Why should an organization plan for a threat actor who has already gained access to its network?

### What a good answer covers - Recognizes that perimeter defenses cannot guarantee that no attacker will get inside. - Explains that restricted access limits what an intruder can reach. - Explains that monitoring and logging support detection and investigation. - Connects timely detection with reducing the amount of harm an attacker can cause. ### Terms - **Threat actor**: A person or group that may conduct malicious cyber activity. - **Perimeter defense**: Safeguards intended to protect a network boundary. - **Logging**: Recording system or user activity for later review. ### Remember Assume a boundary can be crossed, then limit what happens next.