Tests the 80% of the kill chain where defenders have the most opportunity to detect and respond - Provides immediate value even against well-defended perimeters - More cost-effective for testing specific detection use cases - Focuses on what matters most: can you detect and contain an attacker who i