A municipal sponsor starts treating 'number of pivots completed' as the engagement success metric instead of risk to crown-jewel systems. How should the tester recenter the work?
Select an answer to reveal the explanation.
Short Explanation
Pivots are a means of travel, not a trophy wall. Nobody cares that you took sixteen scenic hops if you never got near the systems that matter. Steer lateral movement toward the engagement goals and crown-jewel risk.
Full Explanation
When a municipal sponsor treats “number of pivots completed” as the success metric instead of risk to crown-jewel systems, the tester should recenter by prioritizing pivots that support agreed objectives and demonstrate meaningful risk to crown-jewel assets, not vanity hop counts. Maximizing hop count across every subnet to inflate the metric wastes authorization budget and increases accidental scope breaches. Stopping all lateral movement because pivoting is “always out of scope” misreads typical internal RoE and abandons objectives. Replacing crown-jewel testing with a scorecard of tunnel tools installed measures activity theater, not civic risk. Exam caveat: methodology serves business risk narratives, not leaderboard metrics. Operational check: reopen the objectives list with the sponsor, map remaining pivots to crown-jewel paths, and report impact in terms of municipal functions protected or exposed. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.