Exactly. If it wasn't deployed on May 5th, instead of writing, "when a build deployed to the development tier", I'd expect something along the lines of, "The intrusion originated on May 5 in the development tier".