Happy Halloween. In the spirit of the occasion, here are the findings that genuinely unsettle us after years of assessments.
Not zero-days. Not nation-state tooling. The admin account named 'test' that has been active for three years. The networked printer sitting outside the scope of anyone's hardening policy, accessible with default credentials. The backup solution that logs 'completed successfully' every night and has never once had a restore tested against it.
These aren't rare. They are consistent findings across organisations of every size, sector, and maturity level. The gap between 'we have controls in place' and 'those controls actually work' is where most real incidents begin.
If your organisation hasn't tested those assumptions recently, that's the thing worth worrying about - not the ghost stories.