Counterexample

[upbeat music] So let's go to Organization B because that's where this story flips.

Counterexample, same entry vector conceptually, physically, spear phishing, T1589 for gathering emails off public sites.

Technique 1204 for user execution.

Three users clicked, three workstations were compromised, but every payload execution triggered the exact same medium severity EDR alert, an executable file loaded an unexpected DLL file and SOC staff in Organization B isolated all three workstations within 10, 2, and 20 minutes respectively.