Always Ask Why It Exists

Sketch a tiny mindmap of each service and asset, and always ask yourself why it exists.

For every host, service, file, or account you find, ask why it exists — the purpose usually points you to the intended attack path.