I spent 10 years breaking into companies: Here is what separates a good test from a game-changer

Throwaway because I still sign NDAs.

I've led offensive security engagements for banks, hospitals, and SaaS unicorns. I've cracked Domain Admin in under four hours, and I've spent two weeks straight getting absolutely nowhere because a sysadmin actually knew how to configure AppLocker.

There is a lot of noise in this industry about zero days and APT-level tradecraft. But the conversations I have with security leaders after the report is delivered are rarely about the exploits.

They usually go like this: "We passed the compliance audit, but I still don't sleep well. Am I missing something?"

Here is what I've learned about what actually moves the needle.

The gap between "no criticals" and actual resilience

Most organizations run penetration tests because they have to. Insurance requires it. Regulators require it. So you hire a firm, they scan some stuff, find a missing patch or two, and everyone moves on.

That is not offensive security. That is a hygiene check.

Offensive security is answering the question nobody wants to ask: If a skilled, motivated adversary targeted us specifically—not randomly, but us—would they get in?

And the honest answer, more often than not, is yes. Not because the technology is bad. Because the assumptions are wrong.

The assumptions that break defenses

I sat in a room recently with a very competent IT team. They had invested heavily in endpoint detection. They had segmented the network. They had done the work.

Their assumption was: "If someone gets in, we will see them move laterally."

We didn't move laterally. We sat on a help desk workstation for three days, slowly abusing the tools they trusted. PowerShell. PsExec. Native Windows commands that generate alerts—but nobody looks at alerts from the help desk.

By the time we hit the domain controllers, we were using valid credentials. We looked like administrators. The EDR logged everything. Nobody investigated until it was too late.

This isn't a technology failure. It's a strategy failure. You cannot defend against what you haven't imagined.

The value of a fresh lens

The hardest part of security is not keeping up with threats. It is escaping your own mental models.

You know your environment too well. You know why that legacy server is still online. You know why that vendor integration requires overly permissive firewall rules. You know the history, the compromises, the debt.

An offensive team brings one thing you cannot generate internally: genuine ignorance. We don't know why things are the way they are. We only know what we can abuse.

Sometimes the most valuable finding in a 60-page report is not the critical vulnerability. It is the observation: "I don't understand why this is exposed."

What serious teams do differently

The organizations that improve year over year share a pattern. They don't treat offensive security as a pass/fail exercise. They treat it as intelligence.

They want to know:

• Which attacks generate no alerts at all
• Which user populations are consistently vulnerable
• Which third-party integrations create unmonitored pathways
• Where defenders correctly detected us—and why it took forty minutes to respond

They don't fire the messenger. They don't demand that the test stop when the red team succeeds. They ask: "What else can you show us?"

Offense as a partnership

I used to think my job was finding vulnerabilities. Now I think it is helping security teams see themselves the way an adversary sees them.

That requires trust. It requires the red team to actually understand the business, not just the network. It requires the blue team to share their pain points, not just their topology.

When that trust exists, the engagement stops being a checkbox and starts being the most valuable week of the year.

If this resonates

I wrote this because I keep seeing the same pattern: smart, exhausted defenders doing their best with incomplete information. They know there are gaps. They just can't prove it without outside help.

There are firms that treat offensive security as a commodity. There are also practitioners who treat it as a craft—who care about the business outcomes, not just the shell count.

I run one of the latter. If you are responsible for an environment that keeps you up at night, and you want to talk to someone who has seen how this plays out across dozens of industries, my inbox is open.

No pitch decks. No pressure. Just perspective. Telegram: Divurion