# Post Exploitation Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Impact assessment documents the maximum access level achieved, data categories exposed, and blast radius of each access chain"
- "Lateral movement analysis maps at least 3 potential pivot paths with the credentials or access required for each"
- "Privilege escalation findings document the starting access level, technique used, and resulting access level with evidence"

### Bad criteria — vague (no clear check)

- "Impact is assessed"
- "Lateral movement tested"
- "Data exposure documented"

