Gentlemen leverages compromised identities and trusted admin tools after initial access rather than exploits — therefore controls over privileges and network segmentation must be tested, not merely deployed.