honestly, I love doing DF. For me it's always more like a competition against an Threat-Actor with varying maps/environments. In the end every action leaves a trace, so the puzzle always can be solved.
And after an Incident Managent is so much more aware about recommendations from their IT-crowd.