Matrix phase of attack vs possible courses of action to help categorize capabilities and find gaps/guide spending @mikecloppert #dfirsummit