In an ATT&CK-tagged intrusion, why can Discovery recur three times while Persistence never occurs?

## Repetition and absence are the normal case A tactic column is a goal category. Once you hold that firmly, the two behaviours that look strange — one column visited several times, another never visited — stop being anomalies and become the ordinary shape of a real episode. ### Why Discovery interleaves rather than clustering An operator arrives with a hypothesis and very little knowledge. Every action they take changes what is possible next, and every new possibility raises a question they cannot answer from outside. So looking around is not a phase; it is a habit that recurs whenever the next choice is underdetermined. In the defacement episode, the questions arrive one at a time: 1. What does this platform actually host, and which sections are public? 2. Which template or content files can the account the web process runs as modify? 3. Which pages are served from an edge cache, so a change would not be visible immediately? None of those questions can be asked before the previous answer exists. Question 2 only makes sense once you know which sections matter; question 3 only matters once you know which file you are about to change. This is why a mapping shows Discovery sitting between other tactics rather than as one early block — and why a narration that forces all the looking-around into a single early 'phase' is a distortion of what happened. There is a second reason worth naming: an operator with one foothold and no second host has *only* what that host can tell them. Their picture is narrow, so it has to be refreshed repeatedly as they move through their own decisions. ### Why Persistence can be entirely absent Persistence is a goal with a specific economic shape: it costs effort and exposure now, and it pays off later, by surviving a reboot, a session ending, or a credential change. That trade is only worth making if *later* is worth something to the operator. For a crew optimising for publicity, later is worth almost nothing. The payoff is a public, visible change; once the front page is defaced, the objective is banked. Everything after that point is downside — more actions, more exposure, and an estate whose owner is now looking. A rational operator with that payoff structure stops. So the absence of a Persistence tag is not a hole in the story. It is one of the more informative things the story says: it tells you the operator did not need to come back, which in turn narrows what kind of operator they were. ### The inference you must not make Absence in a mapping means 'no such action was placed in the account'. It does not mean 'no such action existed in the world'. The honest statement is about what was observed, and the reason to keep that distinction sharp is that the two mistakes point in opposite directions: over-claiming ('nothing persisted') and over-hedging ('there must be persistence we cannot see') are both ways of ignoring what the operator's payoff makes likely. The strongest answer reasons from economics — what would returning have been worth to this crew? — and holds the observational limit as a separate, explicit caveat. ### What this means for how an episode is summarised If Discovery can appear three times and Persistence zero times, an episode cannot be stored as a single ordered phase number. There is no honest value for 'which stage they reached' when the operator visited one goal repeatedly and skipped several entirely. What can be stored is the set of tactics observed, each tagged action with its moment, and whether the operator's objective was reached. Those three things are defined for every episode, no matter what shape it took. ### The pattern to carry away Ask of every tactic that recurs: *what new question did the operator have?* Ask of every tactic that is absent: *what would it have bought them, and were they going to be around to collect?* Those two questions turn a flat mapping into an argument about intent, which is the thing an interviewer is actually listening for.