Post-exploitation

The set of actions an attacker takes after gaining initial access: privilege escalation, lateral movement, persistence, and data exfiltration. It is often the most damaging phase, because it turns a minor entry point into a full compromise. Offensive AI agents now automate part of this phase, shrinking the time between intrusion and impact.