Enterprise security models have long assumed that attacks begin when an adversary starts collecting information about a target. That assumption made sense in an era when surveillance, casing, and reconnaissance were visible early indicators of hostile intent. Today, the earliest stages of many attacks occur long before any operational behavior…
