How did they get in? Question number 4 in our Big 4. It may seem counterintuitive to try and solve this last, but in reality, this is often one of the least important questions to answer. Counsel and client always care about data exfil, what systems the threat actor accessed and if they are still here. Usually, when you answer the other 3 questions, the answer for “How did they get in” falls into place naturally.
