What keeps coming back to me is that the attackers aren't clever, they're patient. They run the same handful of techniques against everyone and simply wait for one to be open. So the honest question for this room is which of those techniques is still open in your environment, and what is actually keeping it open?

Patch cadence for us. The fix existed for eleven days before it reached the edge. Nothing exotic keeps it open, just a change window that waits for a committee.

Shared credentials between environments. We keep promising to split them and then a deadline arrives and the shortcut quietly comes back.

Our old VPN range. Two appliances still accept the old ciphers because the vendor stopped shipping updates and nobody wants to be the one who turns them off.

Password reset flows. We spent a year hardening login and the reset path still answers with a yes or no an attacker can learn from.

For us it's admin access on the reporting tools. Every analyst gets it on day one and we've never written down why.

Coming back to this after the night we had. The committee patch window is now a one line exception process and I'm never going back.