tokens: We illustrate this by tackling a problem that has confounded conventional normative - rationality - based modeling approaches : Why do so many APT attacks follow a ' stepping - stone ' penetration pattern ?