Ask questions and find impact

Monitor and manage endpoints

Review recorded state over time

Review past CVE exposure

Target endpoints and collection

Define collected evidence