What a security assessment actually finds

It is rarely anything exotic. It is almost always something ordinary that nobody owned.

People imagine a security review as somebody clever finding an ingenious flaw. In practice the findings are dull and they repeat: software two years out of date, an account belonging to somebody who left, a password reused from a service that was breached, a folder the web server can write to that it has no business writing to.

Dull does not mean harmless. Nearly every compromise of a small business site comes through one of those, because attackers are not looking for you specifically. They are scanning everyone for the same handful of known holes.

The pattern behind all of them is ownership. Somebody installed a plugin for a campaign in 2023 and nobody owned it afterwards. An administrator account was created for a contractor and nobody owned closing it.

So an assessment worth paying for produces two things: a list of what is wrong, ranked by what an attacker would actually reach first, and a shorter list of who now owns each thing that has to keep being true.

The second list is the one that prevents the next incident. The first only fixes this one.