The mean time to chain three findings into full compromise is under two hours. Not the headline criticals — three "low" and "medium" issues that nobody flagged, stitched together into a single path. That's how most real breaches actually happen, and it's the part your vulnerability report is worst at showing you.
Here's the problem with how we triage. CVSS scores rate findings in isolation. A score tells you how bad one weakness is on its own, assuming nothing else around it exists. But attackers don't operate in isolation — they operate in paths. An information disclosure rated 3.1 means almost nothing by itself. Wire it to a misconfigured service rated 5.4, then to a set of reused credentials rated 4.9, and suddenly those three "minor" issues are a clean walk from the public internet to your domain controller. No single finding on that path would have woken anyone up at 2 a.m. Chained, they own you. So the most useful thing on your desk isn't the list of criticals. It's the path hiding inside the list of everything else. Your real risk register isn't a ranked column of severities — it's a map of what those findings look like once you connect them.
Try this. It takes about an hour. Pull your most recent pen test or vulnerability scan. Set the criticals aside for ten minutes — genuinely ignore them. You already know about those; they have tickets, owners, and a deadline. Instead, read every "low" and "medium" finding, in order, top to bottom. Don't skim for the worst one. Read all of them, the way an attacker reading recon notes would. Then ask a single question: which of these, chained together, would get an attacker to a crown-jewel asset? A crown jewel is whatever ends the conversation if it's lost — your customer database, your source code, your identity provider, your finance systems. Trace the path out loud or on paper. Start at something externally reachable. What does it expose? What does that let you reach next? Keep going until you either hit a dead end or hit something that actually matters.
You will find at least one path that nobody scored, because no scoring system scores paths. That's the gap. Every finding on it was visible. The line connecting them was not. It's a 60-minute exercise, but it doesn't stay a one-time exercise — it changes how you read every report after it. Once you've watched a full compromise get assembled out of "acceptable" risk, you stop reading severity columns and start reading reachability. You ask "what does this unlock?" instead of "how bad is this alone?" That single shift is most of the difference between defending findings and defending your actual attack surface.
Block the hour this week. Ignore the criticals. Read the lows. Comment with what you find — I'm curious how many of you uncover a path that was sitting in plain sight the whole time.
1 comment
Tim Winter
I like the intent of looking across all levels of vulnerabilities and identifying the commonalities between them, especially in the wake of Mythos AI and the growing focus on how low-severity issues can be chained together to create high-impact outcomes. Attackers do not experience our environment as a severity table. They experience it as a graph. A low-severity issue may not matter much alone, but when chained with another low, a medium, a weak credential, and an exposed management interface, it can become a high-impact business scenario. Running through this exercise showed how many lower-severity findings were materially reduced or eliminated by remediating the higher-leverage issues. That is an important lesson: we are not only reducing vulnerabilities; we are breaking attack chains. On a related note, I continue to see tremendous value in having a third party perform penetration testing. The value is not just the report or the list of findings. It is the ability to take real scenarios from our own environment and use them with executives to show what is possible right now. That creates a much stronger risk conversation than hypothetical examples or vulnerability counts alone. It is often eye-opening because it connects technical issues to real-world business impact.