@devcoffee Selection/survival bias ("the technique always works in environments where it's the best technique"?) must have a role, good point!
But sticking with your example, having an other family of OS's in the dataset would easily explain the difference to the lab. Today I struggled with a Windows hardening, that seems to be the default, and Win10 should be Win10... Of course MS may roll out hardenings gradually, but somehow it's always like this no matter if I try to exploit an OS privesc or a webapp injection in my own lab (I'm also paranoid I guess :D).