Who’s looking and what are they after? Adversaries with an established foothold in the environment will at some point attempt lateral movement. Similarly, employees with privileged access and a motive for misuse may pose an insider threat.