Time activities to blend with normal business operations - Mimic the target's legitimate network traffic patterns - Use living-off-the-land techniques before deploying custom tools - Monitor for indicators that the blue team has detected your presence - Have contingency plans for each phase of the o