After identifying the vulnerabilities, they are exploited to gain access to the system. After gaining access to the system, attempts are made not only to work on avoiding detection but also to gain greater access to the system as well as additional potential assets. Later the value of the compromised machine or entry point is determined.