Making a list is one thing, executing a real attack is another.