A transit SOC wants to chain initial access → persistence → discovery in one authorized exercise window. What readiness goal does that chaining serve?

A transit SOC that chains initial access → persistence → discovery in one authorized exercise window is exercising end-to-end defensive visibility across multiple ATT&CK stages. Chaining shows whether municipal telemetry and correlation survive progression—not just isolated technique hits. One authorized window with clear stop points lets the team measure path-level readiness for transit identity and SOC tooling across chained stages, rather than reconciling forensic timeline completeness across multiple ATT&CK stages in a single authorized emulation window. Validating incident response containment playbooks across multiple ATT&CK stages in a single authorized emulation window tests active containment and response execution — the transit SOC is validating whether telemetry holds up as the attack progresses through persistence into discovery, not whether responders can successfully contain and recover. Measuring threat intelligence enrichment latency across multiple ATT&CK stages in a single authorized emulation window is a data-enrichment speed metric, not a test of end-to-end defensive visibility across chained ATT&CK stages. Exam caveat: multi-stage chaining increases complexity and blast radius—each hop still needs authorization, monitoring, and abort criteria even inside one window, and you shouldn't confuse that path-level test with reconciling forensic timeline completeness across multiple ATT&CK stages in a single authorized emulation window. Operational check: pre-brief the transit chain’s ATT&CK stages, expected alerts, and hard stop before impact/OT, run within the change window, and score detection/correlation at each hop before closing the exercise.