How does a mass-exploitation crew behave differently from one that had your name first?

## Why this is worth asking An organisation that reads mass exploitation as a campaign aimed at itself will over-buy against a crew that was never coming back, and an organisation that reads a name-first intrusion as bad luck will under-buy against one that certainly is. The two orders diverge in the adversary's behaviour, and those differences are readable without knowing who the crew is. ## The four discriminators **1. The entry path is generic or it is yours.** In selection-after-access the entry is the flaw itself — `Exploit Public-Facing Application` (T1190) against a product thousands of organisations run, taken in exactly the same shape everywhere. Nothing preceded it that was about you. In selection-before-access the path is chosen because it reaches *you*: a supplier that holds access into your estate (`Trusted Relationship`, T1199), an obscure remote-access route that only your organisation has, a system that matters only in your architecture. **2. Simultaneity.** One exploitation run covers the whole enumerated population, so the same foothold appears at hundreds of organisations inside days. A name-first intrusion has no such cohort; the weeks of path-finding happen against one estate. **3. The gap between entry and hands-on work.** This is the most useful and least intuitive one. Exploitation scales; humans do not. A crew that has just acquired several hundred footholds cannot work them all, so access sits untouched for days or weeks while the crew triages, and a large share is never worked at all. A crew that spent weeks reaching a chosen victim does not then sit on the access — the cost has already been paid and the objective is known. **4. Substitution.** The deepest discriminator, because it is about what the crew does when it is blocked. Close a name-first crew's path and it looks for another, because the victim is fixed and the route is negotiable. Close a mass-exploitation crew's path into your estate and there is nothing to substitute *for you* — its economics rest on the other instances it already holds. This is why the same control produces two different outcomes: removal in one order, redirection in the other. ## The trap: specificity after access The most common wrong reading is that specific behaviour inside the estate proves prior selection. It does not. In the selection-after-access order the crew *becomes* specific precisely at the ranking step — it reads what the foothold gives it, decides your access is worth a person's time, and from then on behaves exactly like a crew that chose you months ago. Everything after triage looks targeted, because from that moment it is. The question is only whether the specificity existed *before* entry. ## The case that breaks the binary A managed-service provider's shared tenancy is neither order cleanly, and it is the case an interviewer uses to test whether the distinction is understood or memorised. One entry into the provider yields a list of downstream customers to rank — so, for you, selection happens after access, exactly as in mass exploitation. Yet the target set was fixed the moment the provider was chosen, and it was chosen deliberately, for the leverage its tenancy holds. From the provider's chair this is a name-first intrusion; from a customer's chair it is a lottery drawn from a deliberately chosen pool. The correct answer to *were we targeted* is neither yes nor no: you were selected after access from a set that somebody selected on purpose. ## What the distinction is good for Getting the order right predicts three things. Whether the same entry is still open elsewhere in your estate and at your peers — likely in the first order, unlikely in the second. Whether the crew returns after the path is closed — no reason to in the first, every reason in the second. And which control class removes rather than merely redirects: leaving the enumerable set is decisive against the first order and only inconvenient against the second.