INTUITION-DRIVEN OFFENSIVE SECURITY

Summary from the TLDR InfoSec newsletter

Penetration tests typically focus on finding long lists of bugs in a small time scope and limited attack surface, but attackers are not restricted by time or other scoping and hunt for smaller numbers of critical vulnerabilities. To address this gap, testers should have a holistic view of the application from a user, source code, and architectural perspective, test assumptions that were made during development, and search for a small number of deep bugs. Real offensive security should focus on following intuition, finding the truth, and focusing on impact.