We analyzed 224 penetration tests our team carried out: external (against an organization’s Internet-facing perimeter), internal (inside its network) and web application tests. For each one we recorded every weakness we reported, every step the testers took and how far they got. That lets us answer a question most security programs never ask out loud: of everything we find, what actually gets an attacker access? See page 49 for Five changes that break 94% of network takeover paths!