During an authorized internal penetration test, a tester notices that a mid-range Nmap scan against a /24 subnet is triggering the client's IDS, generating alerts that flood the SOC. The engagement rules require the tester to reduce the likelihood of detection while still completing the enumeration within the testing window. Which Nmap timing option should the tester use to slow the scan enough to evade signature-based rate thresholds while remaining faster than the most conservative setting?