Security Verification and Offensive-Defensive Practice
The two priorities of our safety work might have been reversed
The security team's schedule is always packed to the brim: endless vulnerability review meetings, non-stop SIEM alert handling, and continuous follow-ups on compliance remediation items. Looking at the data, our workload is saturated, and everyone is busy doing something.
But we might all have a lingering question in our minds: why is our team running around in circles, yet during quarterly reviews or when a real incident occurs, it always feels like the overall security posture is improving so slowly?
Where is the root cause of this disconnect between busyness and effectiveness? We took a deep dive into numerous real-world attack cases and, combined with the analysis of front-line teams' workflows, discovered two systemic deviations that might be causing us to engage in "pointless busyness".
Deviation 01.
Security Validation
We are chasing full-volume CVEs, while attackers are precisely targeting highly exploitable vulnerabilities
Our daily vulnerability management basically revolves around Common Vulnerabilities and Exposures (CVE). For a medium to large enterprise, the number of newly added CVEs each year can easily exceed ten thousand. Our job, under the pressure of compliance and audits, is to struggle to prioritize remediation within this massive list based on CVSS scores, asset importance, and other dimensions.
But let's look at what attackers love to use in the real world. Whether domestically or internationally, the vulnerabilities that attackers use most frequently and with the highest success rates are always the same few dozen. Among them, a significant portion are N-day vulnerabilities that have long been announced or even have public exploit tools available, particularly concentrated at the main entrances exposed to the internet, such as OA systems, VPNs, email gateways, and perimeter network devices.
This phenomenon is completely consistent with the approach of the Known Exploited Vulnerabilities (KEV) catalog maintained by CISA internationally.
This means that attackers are not pursuing technological advancement, but success rate and efficiency. They prioritize using those conventional weapons that have already been validated by the market and are the most convenient.
And what about us? We spend a tremendous amount of effort managing those tens of thousands of CVEs to satisfy compliance reports. But for those highly exploited vulnerabilities that repeatedly appear in real-world attacks, do we have a set of processes to ensure they are 100% validated and blocked in our environment?
If the first step of our vulnerability management process were not to sort by CVSS, but first to cross-reference all vulnerabilities with a dynamically updated list of actively exploited vulnerabilities, our to-do list might immediately shrink from thousands of items to just dozens. The focus of our work would instantly become crystal clear.
Deviation 02.
Security Validation
We are heavily defending advanced TTPs, while attackers are roaming legitimately inside
The areas where we invest the most in our defense architecture are usually the perimeter and endpoints. We deploy the strongest firewalls, WAFs, and IPSs, load the latest EDRs and XDRs onto endpoints, and configure a large number of complex rules to detect those advanced TTPs (tactics, techniques, and procedures).
But in the real world, how do many attacks happen? Gaining initial access is often just the beginning. What truly causes massive damage is the lateral movement after getting inside. And what is the most effective and stealthy way to move laterally? It is not various fancy techniques, but credentials.
An attacker exploiting a perimeter vulnerability may just be looking to acquire the most ordinary employee account. Then, using this legitimate identity, they begin a long process of information gathering and legitimate roaming within the internal network. They will use normal operations and maintenance tools and normal access protocols to attempt connections to other machines. During this process, many systems relying on signature libraries and blacklist/whitelist detection might not alert at all, because from a technical standpoint, everything looks normal.
We deploy heavy forces to defend against the thief climbing over the wall, but for the spy who has already blended inside, disguised as an employee, are our internal security measures truly in place? Think about it—would you assume everyone wearing corporate workwear is normal? So, are those using normal operations and maintenance tools and commands all entirely normal? Do not ignore something just because it lacks threat signatures; instead, combine it with behavioral analysis to judge whether it is reasonable.
Security Validation
Calibrating our focus, returning to real-world combat
These two deviations clearly explain why we sometimes feel busy but cannot identify the key priorities. Because most of our energy may be spent addressing theoretical risks.
The direction of calibration is also very clear:
For vulnerability management, the core of the work should be to prioritize the validation and remediation of those vulnerabilities that are actively exploited in the wild.
For threat defense, the core of the work should be to assume that credentials have been compromised and continuously validate whether internal lateral movement paths and permission controls are effective in this scenario. Is behavioral analysis detection based on audit logs effective?
To accomplish these two core tasks, we need a platform that can precisely replicate these real-world attack scenarios. The design philosophy of the CyWall Security Validation Platform is closely aligned with this practical combat principle.
Our attack playbook library updates the world's latest, validated, and actively exploited attack techniques with the highest priority. This ensures that every validation you perform is targeted against the most realistic threats.
We support a large number of assume-breach scenarios. You can easily set up a scenario assuming an ordinary employee's PC is compromised, and the platform will automatically validate which core systems can be reached from this point, exposing internal permission and network configuration issues.
Our daily work should not be hijacked by massive CVEs and theoretical TTPs. Shift the focus of work from managing massive theoretical vulnerabilities to blocking highly exploited attack paths; from over-relying on perimeter defense to strengthening internal defense-in-depth validation. Treat every validation as a real test of our work effectiveness, allowing our busyness to truly translate into an improvement in our security posture.
