Authorized engagement — assuming signed ROE and scope on file. First
question back: what's the crown jewel? An engagement without a defined
objective wanders. Everything below assumes "customer PII in prod DB."

CROWN JEWEL → WORK BACKWARD
Target: prod customer DB. Map the attack paths that reach it, then pick
the one with the lowest OPSEC risk, not the flashiest.

ATT&CK KILL-CHAIN PLAN
  Initial Access   T1566 phishing (likely) vs T1190 exposed service
                   Score by detection risk: phishing trips the SOC less
                   than scanning your perimeter does.
  Execution        T1059 — living-off-the-land, not custom malware
  Persistence      T1053 scheduled task — minimal, objective-scoped
  PrivEsc          T1068 / T1078 — valid accounts beat exploits on OPSEC
  Lateral Movement T1021 — the choke point analysis below
  Collection       DB access → objective

CHOKE POINTS — where the whole path funnels
The path to prod almost certainly routes through:
  • a jump host / bastion, and
  • a service account with DB creds
Both are single points the defense can watch. If you can't get through
the bastion undetected, the rest of the plan doesn't matter — pressure-
test that first, before burning a phish.

OPSEC RISK RANKING
  HIGH   network scanning, credential brute force, new binaries on disk
  LOW    valid-account reuse, LOLBins, DB access during business hours
Prefer low. The goal is to test detection, and getting caught on recon
tests nothing.

CROWN-JEWEL TARGETING
Don't touch the DB until you have a clean, repeatable path. The
objective is demonstrating the path exists, not exfiltrating the most
rows.

REPORTING FRAME
Every finding maps to an ATT&CK technique + the specific detection that
should have fired and didn't. That's what makes the report actionable
for the blue team rather than a war story.

Confirm the crown jewel and I'll score the two initial-access options in
detail.