Picture the report most organizations receive every month: thousands of findings, a few hundred marked critical, sorted by score. Now picture how a real intrusion usually goes. An employee falls for a phishing email. The attacker finds that the local administrator password on that laptop is the same on hundreds of others. One of those machines has an administrator’s credentials cached in memory. Within a day, they’re a domain administrator.
Not one of those steps would appear as a critical vulnerability. Shared local admin passwords, cached privileged credentials, weak service account passwords and flat networks don’t have CVE numbers. They’re configuration and design choices, and they’re how most environments actually fall.
Attackers don’t exploit your top CVE. They chain together the boring weaknesses your scanner doesn’t score.
Fix what’s being exploited before what scores highest
For the CVEs you do track, prioritize by evidence of real-world exploitation rather than severity alone. CISA’s Known Exploited Vulnerabilities catalog lists flaws attackers are using now; exploit prediction scores estimate the likelihood of exploitation in the coming weeks. Cross that with what is exposed to the internet and what’s critical to the business, and a list of thousands becomes a list you can actually finish.
Hunt for the weaknesses that chain
The findings that matter most rarely come from a scan. They come from asking how an attacker would move. The usual suspects we look for:
- The same local administrator password across many machines
- Privileged credentials cached on ordinary workstations
- Service accounts with weak passwords that can be cracked offline
- Remote access or VPN without multi-factor authentication
- Flat networks where a compromised laptop can reach servers, backups and production-connected systems
In manufacturing, that last point deserves special attention. If corporate IT and systems connected to production sit on the same flat network, an ordinary phishing compromise can become an operational incident.
Test attack paths from a realistic foothold
A penetration test that scans a list of IP addresses mostly rediscovers what your scanner already knows. A test that starts from a realistic foothold, such as a phished user’s laptop with no special access, and tries to reach your most valuable systems tells you something new: whether your defenses hold together. Assumed-breach testing is often the most valuable money you can spend on offensive security.
Close the loop with detection
Every technique a tester uses successfully is a detection your SOC should have. Feed test findings straight into detection engineering, then retest. If the same path works twice, the finding was never really closed.
What to tell the board
- How many paths to your critical systems testing found, and how many are closed
- Exposure to actively exploited vulnerabilities over time
- Remediation within agreed deadlines, by risk level
- Detections added as a result of testing
A clean scan report is a comforting document. A tested, closed attack path is actual security.