It was sometime past midnight when I caught the thing that changed how I think about this entire field.
I wasn’t at a client site. I wasn’t in a meeting. I was sitting at my desk — same desk, same dual monitors I’ve stared at for more hours than I can count — running a red team simulation against our own platform. Just me, a terminal, and a fresh build of something I’d spent weeks writing.
The scanner ran clean. Every CVE it was supposed to flag, it flagged. Severity scores rendered exactly as designed. The dashboard lit up the way dashboards are supposed to light up when they’re working correctly. By every internal metric I’d defined, the system had done its job.
Then I did something a bit stupid, or maybe the most useful thing I’d done in months: I pretended to be the attacker.
Not a theoretical attacker. Not the attacker described in the OWASP documentation or the NIST framework or any of the literature I’d absorbed building this thing. I pretended to be the specific, actual kind of person who would want to get into the kind of organization we were trying to protect — someone who had studied the target, knew its industry, understood what was valuable inside it, and had time.
The path I found into the simulated environment had not triggered a single alert. The vulnerability it passed through had a CVSS score of 4.3 — medium severity, not even in the top fifty findings the scanner had surfaced. On its own, in isolation, scored against a generic rubric, it was unremarkable. In the context of this specific architecture, sitting next to two other unremarkable findings, it was the door.
I stared at that for a long time. Not because I was surprised that the scanner had missed it — I understood the technical reason it had. I was staring because I had written that scanner. I had designed its logic. I had decided what it prioritized and why. And standing on the other side of it, thinking like someone who wanted in rather than someone who wanted to protect, I could see, very clearly, exactly what I had built wrong.
Not the code. The thinking behind the code.
The Assumption Baked Into Everything
Every line of security software I’ve ever written — and at this point there’s quite a lot of it — starts from a set of assumptions about what security is. What matters. What counts as a threat. What a defender needs to know.
Most of those assumptions, I absorbed from the industry. Severity scoring from CVSS. Threat taxonomies from MITRE. Priority frameworks from the major vendors, the compliance bodies, the certification curricula. I didn’t question them because they were the foundation. You don’t question the foundation while you’re trying to build the house.
But that night, sitting with a terminal and a finding with a CVSS score of 4.3 that I had just used to walk through a simulated enterprise like the door was unlocked, I had to confront something uncomfortable: the foundation had been poured for the wrong building.
Full article: https://medium.com/@bensylvenus/how-i-built-the-perfect-security-scanner-052afbfbab96?postPublishedType=initial
Top comments (0)