A representative red team assessment, told day by day: how one convincing phishing email turned into domain admin in six days, and the three controls that would have stopped us cold.