Visibility & Logging
5 entriesWhat you can’t see, you can’t investigate. Logging that’s absent, too short-lived, or unreachable exactly when it matters.
Categories
Seven families, chosen to describe where the failure sits structurally — not by the attacker’s technique.
Identity & Trust Boundaries
5 entriesPoorly established or poorly revoked trust boundaries: identities, sessions, service accounts, standing privileges.
Detection & Response Process
4 entriesThe signal exists, but the process fails to turn it into action: triage, escalation, post-block verification.
Backup & Recovery Architecture
3 entriesBackups exist but are reachable by the attacker, untested, or dependent on the same trust plane as production.
Governance & Authority
5 entriesNo one has the mandate to make decisions during the incident: isolation authority undefined, plan never tested, scope of intervention unclear.
Third-Party & Insurance Readiness
2 entriesEssential external responders are discovered during the crisis instead of being lined up beforehand: insurance, legal counsel, service providers.
Failures specific to managed service environments, where the compromise of a shared access point extends the blast radius across multiple client environments.