Pentest scenarios based on an internal ‘attacker’ , like a legitimate infrastructure user or visitor with only physical access to organization network or a guest with limited systems access