Exercise 3: Why "Assumed Breach" Testing Is Often More Operationally Valuable — Possible Solution
====================================================================

WHAT THE ASSUMED BREACH PHILOSOPHY IS
------------------------------
Per this chapter, "assumed breach engagements deliberately start from
a different position: rather than asking 'can an attacker get in at
all,' the tester is given an already-compromised low-privilege account
or workstation access from the start, and the engagement asks 'given
that a foothold already exists, how much access can genuinely be
reached from here.'"

THE CONNECTION TO PENTEST1-2'S GRAY BOX AND INTERNAL CATEGORIES
------------------------------
Per this chapter, "this connects directly to pentest1-2's own Gray Box
(partial starting access) and Internal engagement categories." An
assumed-breach engagement is essentially a deliberately extreme
version of both: Gray Box already establishes that a tester can
usefully start with SOME pre-existing access rather than none, and
Internal engagements already establish that testing from inside the
network (rather than the outside perimeter) simulates a genuinely
different, realistic threat. Assumed breach combines both ideas
explicitly and intentionally, using a real, pre-granted foothold as
the deliberate starting point rather than something the tester has to
independently earn first.

WHY IT'S OFTEN MORE OPERATIONALLY VALUABLE
------------------------------
Per this chapter, "real breaches rarely start with a sophisticated
zero-day — they usually start with something mundane, like a phishing
email or a single leaked credential." This is the load-bearing reason:
a traditional test that spends most of its time and budget proving
that the perimeter CAN theoretically be breached is, in a real sense,
re-confirming something organizations should already assume is
eventually true given enough attempts (phishing succeeds often enough
in the real world). What a real organization often needs to know
MORE is: once that ordinary, everyday kind of breach happens — as it
statistically will, eventually — how much actual damage can be done
from there? Assumed breach skips straight past re-proving the
(usually already-known) fact that a foothold is achievable, and
instead spends the engagement's limited time and budget on the
question with genuinely higher, more actionable operational value:
what internal defenses (segmentation, monitoring, privilege
boundaries) actually limit the damage once a foothold exists.

WHY THIS WORKS AS AN ANSWER
------------------------------
It defines the assumed-breach philosophy in the chapter's own terms,
explicitly ties it to both named pentest1-2 categories rather than
just one, and explains the specific, stated reasoning (breaches
usually start mundanely, so post-foothold defense matters more in
practice) rather than a generic "it's more realistic" claim.