Explain why defenders should monitor for activity at several stages of an attack rather than focusing only on initial compromise.

### The concept Initial compromise is only the first successful entry. An attacker may then establish a foothold, seek a way to return, increase privileges, learn about connected systems, and move laterally. The attacker’s mission may occur only after these actions. Because the material notes that attackers can maintain access over an extended period, defenders should consider indicators across the life cycle rather than treating the first entry as the only meaningful point for detection. ### What a good answer covers - Identifies that the life cycle includes multiple post-entry stages. - Notes that attackers may persist over time. - Explains that detection and response can occur at several stages. ### Terms - **Foothold**: An initial position or continuing access within a target environment. - **Lateral movement**: Movement from one system or area of an environment to another. ### Remember A successful initial entry does not mean the attacker has completed the mission.