They begin with a blind spot such as a missed patch, a dormant account, a device outside corporate security control or a ...