The right first engagement. Everything exposed, triaged by hand, ranked by real risk.
Are they already inside? Hunting the traces an intruder leaves, not the holes they could use.
Network, web app, and wireless. Findings chained the way a real intruder would, with evidence.
Goal-based and quiet. Not "can it be broken" — "can anyone tell while it's happening."