It's nitpick, but I'll note that it follows that you wouldn't know if the attacker has access if you don't know how they gained it.