Priv Users (source: Ofélia Malheiros)

[pbjason9]

I understand you included, Supply chain compromise T1195.002, to address supplier software compromise and include vulnerability management mitigations, just like at T1210. And AF-019, "scan the components on the network".
Unfortunately, threat agents are targeting privileged users (IT, suppliers, which maybe working remotely) to access internal networks and do lateral movement... If applications are not updated regularly or if there are not compensatory controls, the risk of compromise increases.