What about when an engagement doesn't go as planned? What happened and what did you take from it?

I would say the most common mishaps we encounter are not fully preparing the client for the test.

the setup for the test is kind of compensating for the fact that when we're testing, there's certain things we won't do.

Social engineering, for example.

We have a time limit.

We have a bunch of limitations that a real attacker wouldn't have.

So there's kind of an agreement between us and the client that we're not going to use these methods and they're not going to do the things that make those methods necessary.

Any thoughts there?

What about when an engagement doesn't go as planned? What happened and what did you take from it?

I would say the most common mishaps we encounter are not fully preparing the client for the test.

the setup for the test is kind of compensating for the fact that when we're testing, there's certain things we won't do.

Social engineering, for example.

We have a time limit.

We have a bunch of limitations that a real attacker wouldn't have.

So there's kind of an agreement between us and the client that we're not going to use these methods and they're not going to do the things that make those methods necessary.

Chris, from your perspective, you know, education and your background, diverse CTI, forensics, any thoughts there?