Pentesting against a well-defended organization can either be the worst experience or the absolute BEST experience. Let me explain… It can be the worst if you think you’re only there to hack stuff… It can be the best if you realize you’re there to help the company improve… Didn’t find any critical vulnerabilities? Good. Found some “small” thing that seems like it doesn’t matter all that much? Good!
It can make you get creative. Cant get in with an off the shelf python script? My proudest moments didn't result in Domain Admin, but still could have been catastrophic losses for the orgs and used tools I made myself.
Nothing like having to write the report after demolishing a company on a test 😭
True, no findings aren’t a failure, they are validation. But overlooked gaps can always snowball into bigger risks down the line.
Cybersecurity Consultant and Content Creator | Principal Penetration Tester at KPMG Norway
1moIts also an opportunity to highlight the great work that has been done by the organisations security team🙌