cybersecurity

The Under-Discussed Metric from Penetration Test Reports

by Taylor Craig

Why Risk Over Time Matters More Than a Single Test

As part of my time spent as a penetration tester, I have written and reviewed hundreds of reports on the security posture of countless clients. When reviewing these reports, whether from the tester or client perspective, the first thing anyone typically notices is the overall risk or threats currently facing the organization.

However, I would argue that one of the most important metrics I look at for returning clients is their security posture over time. If you are senior management, this is the metric that should interest you the most. In the following article, I will outline why this matters and how to ensure your organization is moving in a positive direction.

What Consistent Testing Really Tells You

In my professional experience, it is incredibly rare to test a client whose network security is without issues, or even limited to only a few low-risk findings. The few cases where I have seen this are clients that consistently engage in annual penetration tests and actively use the results to strengthen their security posture.

When you have recurring tests, I believe it becomes less important to focus solely on your current security posture and more important to evaluate your posture over several years. This historical view helps determine whether your organization is genuinely improving and withstanding new and evolving attack methods.

The Role of Management in Turning Findings Into Action

An effective penetration test report should provide clear and actionable remediation or mitigation guidance for every reported security finding. With this information in hand, management’s responsibility is to create a plan of action to remediate these issues in a timely and effective manner.

That said, a good penetration tester understands that some security recommendations may conflict with business needs. In these cases, it is management’s responsibility to determine whether a risk should be accepted.

When Mitigation Isn’t Possible: Detection and Response Still Matter

Responsibility then returns to the penetration tester to provide mitigations that minimize business impact. If even mitigation negatively impacts business functionality, the tester should, at a minimum, assist with recommendations for implementing effective detection and response procedures for those accepted risks.

Without digressing too much, this also highlights the value of engaging in Purple Team exercises with your penetration testing partner, when available.

Using Historical Trends to Measure Security Program Maturity

Tracking historical risk trends can be a strong indicator of a security team’s conscientiousness. Barring new or novel exploit techniques, or business-critical functionality that prevents certain mitigations, your organization should see a positive year-over-year trend in penetration test results.

A lack of this positive trend may indicate that security findings are not being addressed effectively, or that sufficient planning and accountability are missing within the security program.

Real-World Example

To provide a real-world example, I worked with a client we tested over multiple years. One vulnerability identified during an engagement involved several Active Directory Certificate Services (AD CS) templates vulnerable to the ESC1 exploit.

Without going too deep into technical detail, the core issue with this vulnerability is that a certificate requester leveraging a vulnerable template can specify an arbitrary Subject Alternative Name (SAN). This means that any user, regardless of permissions, can request a certificate for an administrator account, allowing for a straightforward privilege escalation [2].

The above image is an example of the exact circumstances one would expect for an ESC1 vulnerable template [1].

As mentioned earlier, this client had several ESC1-vulnerable templates enabled in their AD CS infrastructure. The findings were reported and detailed remediation and mitigation guidance were provided, along with supporting documentation.

Fast forward to the following year when we tested the same client. While enumerating their AD CS environment, several ESC1-vulnerable templates were discovered. After cross-referencing the prior year’s report, it was determined that these were not the same templates previously identified.

This led to the conclusion that while the client had remediated the original vulnerable templates, they failed to implement internal procedures for securely creating new ones.

What Recurring Vulnerabilities Say About Your Security Program

Recurring vulnerabilities like this are a strong indicator of a low-conscientiousness security program. Fixing individual findings without addressing the underlying process issues almost guarantees the same problems will resurface over time.

Accountability After the Report Is Delivered

As a manager, it is your responsibility to ensure that after a penetration test report is delivered, your security team implements a concrete remediation plan—clearly defining how and when findings will be addressed.

If remediation is not feasible, effective mitigations must be put in place, including tuned alerting and response procedures to detect exploitation attempts early. Proper procedural documentation, ownership, and long-term accountability are critical to preventing the same issues from reappearing year after year.

Citations

[1] https://www.beyondtrust.com/blog/entry/esc1-attacks

[2] https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf

Are cybersecurity-related college programs still valuable?

by Taylor Craig

Since 2022, I have had the pleasure of serving as a member of the Ozarks Technical Community College (OTC) advisory board for their IT and Cybersecurity programs. In our most recent meeting in November 2025, we began to realize just how quickly technology is evolving within this already fast-changing field. With this evolution come new and ever-expanding technical requirements that students, and even working professionals, must learn to stay relevant. This raised an important question: Are cybersecurity-related college programs still valuable?


To cut to the chase, my short answer is yes, but mindset changes are needed. In the following sections, we’ll explore the current challenges, how to address them, and what both students and professionals can do to stay competitive in this field.

The Problem with Over Reliance on College Programs


The primary issue with relying too heavily on college programs in technical fields is that by the time you graduate, many of the specific tools or technologies you learned may already be outdated or rarely used. Similarly, programs that focus too narrowly on preparing students for specific industry certifications often lead to the same outcome — short-lived relevance.


The solution lies in emphasizing core foundational concepts that remain valuable for years, if not decades. While I’ll focus primarily on cybersecurity, many of these principles also apply to system administrators and engineers. We’ll start broadly, then narrow our focus to more specific, actionable areas.


The CIA Triad and IAM as Foundational Concepts


I firmly believe that security can be understood through the CIA triad: Confidentiality, Integrity, and Availability. Additionally, concepts such as Authenticity and Non-repudiation have been included in many professionals’ minds as critical. A solid grasp of these pillars is essential for any security professional. Without understanding their importance, one’s effectiveness in the field will always be limited.


Building on that foundation, one of the most critical, yet often overlooked, areas is Identity and Access Management (IAM). Microsoft defines it well:


Identity and access management ensures that the right people, machines, and software components access the right resources at the right time.[3]

In my view, IAM accounts for at least 80% of security administration. It encompasses identity, authentication, authorization, and access control — each of which could merit its own detailed discussion. (In fact, you can find a separate article on authentication right here on this website.) I’ve also included a link in the references to an excellent external IAM article that I recommend reading and understanding.

Threat Detection and Incident Response


If IAM represents 80% of effective security administration, the remaining 20% falls into threat detection and incident response — two areas that go hand-in-hand in real-world practice.
Over the years, in both blue team and red team roles, I’ve often seen blue teams rely too heavily on built-in or “canned” alerts within tools like EDR and SIEM platforms. It’s critical to customize and fine-tune these tools to your specific organization and threat landscape.
To do this effectively, a security professional must understand not only specific attacks but also the broader methodology attackers use. Ask yourself:

  • What are the early signs of intrusion?
  • What will the attacker likely do next?
  • How can we anticipate and mitigate damage?

A good way to structure this understanding is to study the typical attacker workflow:
Information Gathering & Reconnaissance → Enumeration → Exploitation → Privilege Escalation → Persistence


For a more theoretical framework, explore MITRE ATT&CK [2], which does an exceptional job of categorizing known attack methods, mitigations, and detections. For a more hands-on approach, I highly recommend Try Hack Me (THM) [1], which offers guided labs to learn offensive and defensive techniques in a safe environment. Remember: the most effective defenders are those who think like attackers.
Advice for Students and Professionals

Advice for Students and Professionals


Whether you’re a college student beginning your journey or a working professional, try to map everything you learn to one of these core concepts. Once you’re in the workforce, never rest on your laurels. Take every opportunity to learn new technologies, assist on new projects, and expand your skill set. Use college as a way to learn how to learn — not as the final word on what to learn.
In summary, focus on mastering broad, enduring concepts rather than chasing every new tool or platform. Technologies will always change, but principles like IAM, threat detection, and incident response will continue to form the foundation of effective cybersecurity practice for years to come.

In summary, focus on mastering broad, enduring concepts rather than chasing every new tool or platform. Technologies will always change, but principles like IAM, threat detection, and incident response will continue to form the foundation of effective cybersecurity practice for years to come.

[1] Try Hack Me

[2] MITRE ATT&CK

[3] Microsoft IAM

My First Help Desk Job: Lessons Learned

by Taylor Craig

Your first IT job can be one of the most exciting and nerve racking experiences of your professional career, at least that is how it was for me- up to the day I was terminated nine months later. In this article I want to share some of my experiences, mistakes, and advice I would like to share with others starting their first job in this awesome field of work and how I hope yours will be much better than my own.

I’ll provide a key takeaways section near the bottom for those that want to save themselves from my internet ramblings.

The before time

First I’ll give a quick background of my knowledge and skill set entering my first position. I was never one of those people in this industry you hear so often who was fascinated with computers and had been tinkering with them from an early age. I always had a passing interest in them watching some of the things my older brother of nine years would do with them, but the passing part would come anytime I would pass by or think of the stacks of massive C++ or Windows administration books he would have scattered around his room and desk. My brother was a very intelligent person and I was had the mindset of, “Well I could never be smart enough to work with computers or understand those books of his.”. Obviously I know now how silly this thought was and still is when talking to other curious people like I was, but I digress. It wouldn’t be until around 2014/2015 when I would begin seriously considering IT as a career path.

This consideration began after a discussion one evening with a close friend of mine whom was approaching the completion of their associates degree in Networking Technology from our local community college. Hearing them talk about how much they enjoyed working in IT was very enlightening, especially in contrast to many people I would hear mention their job with dread and melancholy. This really piqued my interest since I currently had no long term career aspirations or plans at the time, and was still trying to determine what I wanted to do with my life. The following semester I enrolled in the same program my friend was just finishing. I performed quite well in the program despite having little to no in-depth understanding of computers or networks (I didn’t even know what a router was beyond-the box that gives you internet). I made up for this lack of knowledge with a very high commitment to understand these concepts, a trait that I feel describes my entire professional experience. In those earlier intro courses I would stay late very often to ask for further elaboration or clarification on the previously discussed topic (Shout out David Pope). This resulted in me completing my program with quite high grades overall, at least for me, in the fall of 2017 where my next challenge awaited me.

Foot in the door

Near the end of my last semester a different friend of mine whom at this point was well established and respected within the industry got me in connection with my first IT job.

Shortly after my friend putting me in connection with the IT manager and following a short phone call with him I was invited into their office for a formal interview. This interview was made up of the manager and both system admins. This has been about five years as of writing this so my memory may be a bit fuzzy on the details, but I will try and highlight a few aspects of the interview to help others in this position. I was asked about some of my college courses, which are my favorite, what challenges I faced, how I overcame said challenges, and if I had any personal technology related projects. After the interview I was given a short written exam to test my technical knowledge. I want to say there were about twenty questions almost all of which I felt confident in my answers. These were relatively simple questions one would learn in an introductory course such as- “What protocol would you expect to see running on TCP port 445?”, or “What is DNS short for?”.

This should go without saying, but do not lie or exaggerate your knowledge or experience, certainty not in an entry level position. They are aware you have no “real world” experience and are usually just looking to see that you are professional, have some basic knowledge, and an interest in the field.

Later that week I was extended an official offer from the company for the position. The salary for the position was around $28,000 and this was late 2017. I feel it’s important to share our salaries, at least past salaries to help others know what they should expect and what is fair. At the time, I believe this was very fair and although it was about what I was making bartending and serving I was still ecstatic to get my first salaried position.

Not a great start…. Not a great end

So my first week felt like I was drinking from a fire hose. This being my first experience seeing anything and learning about a network of this size was very daunting, but exciting. I felt like the sysadmin that was walking me through various things would think less of me or possibly even laugh if I asked what I perceived as dumb questions. This leads into two major mistakes I made going into this job of which I am sure you are already noticing. Failing to ask questions when appropriate, and not adequately taking note of the different concepts and techniques being taught to me. I’ll go a little bit more into detail on each of these and how I would recommend to my successors how to avoid these pitfalls in their first IT job.

When starting any new job, not just an entry level one, you should never worry about asking someone what you may consider dumb questions. It is always better to clarify and understand a topic rather than just pretending you know it because you feel you should. If your colleague or supervisor scoffs at these questions I would recommend immediately looking for a new position because it is not going to get any better for you, unfortunately.

This leads into the next issue I previously mentioned- not taking proper notes. When I started and one of my colleagues would demonstrate the process for a particular task and I would think to myself, “Okay, that wasn’t too much or too complex; I’m sure I’ll be able to remember that.”. The issue would arise though when I would be shown dozens of process or procedures throughout the work week. When I would need to execute one of these procedures that I had observed possibly weeks prior I would only have a slight idea of how to go through the process and need to ask someone for assistance. In this line of work, or any technical field this is just not a sustainable form of working and learning for the vast majority of the population. I have learned from my mistakes and now will write out detailed steps of the process if it has more than one or two steps in its entirety if there was not already documentation made by a coworker.

It’s at this point in this article I was debating on how far I should go into detail on the slow steady decline of my performance (or rather perceived performance) at this position that lead to my eventual termination. Although I have decided I will forgo this details for the sake of both brevity and professionalism.

Ultimately my short comings and issues were my responsibility. I made mistakes. Some I learned from immediately and made the appropriate corrections, while others may have taken quite a few mistakes before making those corrections. Though I would be remiss if I did not also bring up issues with the team/management. As mentioned previously, my intention is not to write up this entire autopsy and criticize those that helped start my career and taught my many foundational knowledge that I still carry into my job to this day. Although I do believe there was a disconnect in what was expected of me in terms of knowledge and skill and what I was able to bring to the team at that time.

I had this help desk position for about nine months before I was terminated. I was both incredibly upset as one could imagine, but also incredibly relieved as the stress and anxiety this position caused was becoming nearly unbearable near the end. Thankfully just a few months later I was able to land a great opportunity to work on my first blue team with an incredible team and management.

Looking back at this help desk position, at the end of the day it just wasn’t a good fit for either me nor the company. Sometimes that happens and that’s alright. You will find yourself in a position or company that isn’t going to make you or them totally satisfied. My only advice is to try to determine this early and not waste the time and effort for either party. With remote work in the field of IT and cyber security becoming more common there are hundreds of incredible teams and companies out there that will make a perfect professional relationship- don’t settle.

Key Takeaways & Suggestions

  • It’s okay to not know something or to have questions. Ask questions and clarify topics early and often. If senior admins or managers treat you poorly for this- immediately begin looking for a new position.
  • Take extensive notes. You won’t be able to remember everything you are taught in any technical job. Take good notes and document processes and procedures. Not only will it make your job much easier, but it will also instill confidence in your supervisors/coworkers that you are truly listening and understanding the topics they are demonstrating to you.
  • On note taking: I would highly suggest using an hierarchical note taking application such as Evernote, OneNote, Obsidian, or even CherryTree. I may also just have a note pulled up to use as a daily “scratch pad” for quick and simple notes on something I’m doing at that very moment.
  • Problem solving and escalation: I did not touch on this during the article but I feel it’s important to mention for anyone starting out in IT. Before trying to immediately escalating a ticket to a more senior person always check internal documentation, Google (an invaluable tool), and vendor documentation. This will all depend on both the structure of your organization and when you are to escalate tickets and the severity of the issue.