Scanners answer a useful question: what might be wrong. They cannot answer the question leadership asks: what can an attacker actually reach. Moving between the two is a change in how findings are produced, prioritized and closed.
1. Define what a finding is
Adopt a single rule: a finding requires a successful action and the evidence of it. Everything else is an input to testing rather than an output of it.
2. Prioritize by reach
Rank by what the path terminates in. Exposures that reach sensitive systems or data outrank exposures with higher generic scores that reach nothing.
3. Close by re-test
- Remediation is proposed against the chokepoint hop
- Fix is deployed
- The path is re-attacked
- The finding closes only if the path can no longer be walked
4. Make it continuous
Tie testing to change rather than to the calendar: deployments, permission changes, new integrations, model and prompt updates.
Tags
- program
- validation
- prioritization