Grading on a curve: How to assess a pentest

This article argues that security teams should prioritize detecting high-fidelity tactics, techniques, and procedures (TTPs) that meaningfully indicate malicious intent and allow early disruption of an adversary's multi-stage campaign, rather than attempting exhaustive detection of every atomic action or test artifact. It contrasts real threats with constrained red-team or pen-test activities and emphasizes balancing detection coverage to avoid overwhelming analysts with false positives while still enabling effective interruption of attacks.