A municipal high-value server has antivirus disabled and no EDR present. How should the tester report that condition in a privilege-escalation / post-exploitation context?

Missing or disabled antivirus and EDR on high-value systems reduces detection and response friction for post-exploitation and privilege-escalation activity. Testers should document the control gap as an enabling risk while still evidencing concrete misconfigurations or privileges. Absence of tools does not remove the host from scope nor guarantee every technique works. Network firewalls do not substitute for healthy endpoint controls on the host itself.