When an unauthorized person gains access to a secured premise, the immediate step is to understand the extent of the breach. This involves tracking the movement of the attacker within the enterprise to determine which areas were compromised. Identifying the attacker's movement helps in assessing the potential impact and aids in the development of an appropriate response plan. It is crucial to understand where the attacker went and what they had access to before further steps can be taken, such as changing access controls or determining the assets that might have been handled or acquired