logging is high enough at the moment it runs. Quiet, valid-credential moves (lateral movement, DC pivot) evade medium logging and stay invisible. Blue acts on its own picture: Isolate all compromised and Reset exposed credentials only touch what's been detected, and Threat hunt is how you reveal the rest. Posture is computed on ground truth; the believed line shows what blue would conclude from its visibility alone. Durations are illustrative — tune them to your environment.