When $client starts screaming "APT! Russia! APT!" after I show them the results of the forensic analysis.. and it was their four year old Wordpress install.