By Alok Ranjan,Founder & Director— Cyeile
I’ve lost count of how many vulnerability assessment and penetration testing (VAPT) engagements I’ve sat through — as an assessor, as a reviewer of findings, and occasionally as the person explaining to a CISO why the “critical” on page one isn’t actually the scariest line in the report. Across all of that, a handful of patterns keep repeating themselves. None of them are exotic. That’s the uncomfortable part.
Misconfigurations are still the quiet majority
Ask any pentester what they find most often and it’s rarely a zero-day. It’s a misconfiguration: an S3 bucket or blob container left with looser permissions than intended, an admin console reachable from the internet because a firewall rule was “temporary,” default credentials that were never rotated after a proof-of-concept became production, verbose error messages leaking stack traces and internal paths, or overly permissive CORS policies nobody revisited after the API grew past its original scope.
None of these require sophisticated exploitation. They require someone to look. That’s precisely why they survive — they don’t trip alerts, they don’t crash anything, and they don’t show up in a vulnerability scanner’s CVE feed. They show up when a human being methodically checks configuration against intent — which is exactly the kind of manual review Cyeile’s VAPT engagements are built around.
Unpatched systems: not a patching problem, a prioritization problem
Most organizations I’ve assessed do patch. The gap isn’t willingness, it’s sequencing. Patch management programs tend to optimize for “what’s easy to patch on a schedule” rather than “what’s actually reachable by an attacker right now.” The result is a familiar shape: internet-facing systems get attention, but the internal jump box, the vendor-managed appliance nobody has admin rights to, or the legacy application that “can’t be touched until the Q3 migration” quietly accumulates months of known, exploitable CVEs.
In practice, the systems that end up as the pivot point in an engagement are rarely the ones flagged as top priority in a risk register. They’re the ones that fell through a process gap — asset inventories that don’t match reality, ownership that’s unclear, or a maintenance window that keeps getting deferred — the kind of gap a structured vulnerability assessment is designed to surface before an attacker finds it first.
The human factor still decides most outcomes
Technical controls have gotten measurably better over the last several years. Segmentation is tighter, EDR coverage is broader, MFA adoption has genuinely improved. And yet initial access in a red-team-style engagement still comes disproportionately from people, not machines: a well-crafted phishing email that survives a busy inbox, a helpdesk process that will reset a password over the phone with minimal verification, a shared credential passed along in a Slack thread months ago and never rotated, or simply someone with legitimate access who wasn’t trained to recognize what a targeted lure looks like.
This isn’t a call for more generic awareness training slides. It’s a case for testing the human layer with the same rigor applied to the technical layer — social engineering scenarios built around how the organization actually operates, not a generic template — something Cyeile’s social engineering assessments are designed around.
What tends to separate resilient organizations from the rest
A few things consistently show up in organizations that handle findings well:
- They treat a VAPT report as a prioritization exercise, not a checklist — fixing what’s exploitable and reachable first, not what’s alphabetically first in the document.
- They close the loop on retesting instead of assuming a fix landed correctly.
- They maintain an asset inventory that’s actually current, so “we didn’t know that system existed” stops being an answer.
- They fold social engineering results into the same remediation tracking as technical findings, instead of filing them separately as an HR matter.
None of this is glamorous. It’s mostly discipline applied consistently over time — which, if I’m honest, is the actual finding behind most of my findings.
This piece draws on patterns observed across VAPT engagements and is intended as a practitioner perspective rather than a vendor-specific report. For more on VAPT and security assessment services, see www.cyeile.com.
