Initial access brokers are specialising by sector

Access is sold with the specificity of a sales lead: sector, approximate turnover, seat count, and which endpoint product is deployed. Buyers pay a premium for environments where their tooling is known to work.

For defenders this means the attacker frequently knows your stack before the first action. Detection strategies that depend on the adversary being unfamiliar with the product are worth reconsidering.