# Exploitation Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Each exploit attempt is logged with exact timestamp, tool/technique used, target, and outcome (success/fail/partial)"
- "Proof-of-concept demonstrates impact without causing data destruction, service disruption, or scope violation"
- "Access log documents the full chain from initial vector to achieved access level with reproduction steps"

### Bad criteria — vague (no clear check)

- "Vulnerabilities are exploited"
- "Access is gained"
- "Exploits work"

