It was the flaw someone designed.
Somebody leaves credentials in plain text, with enough connection detail to make them useful, somewhere far more people can reach than ever should. You've seen this one. Everybody has, which is exactly why it still works.
More often than anyone admits, a person finds it, somebody doing routine work who notices what shouldn't be there and reports it. Not a tool, not a scan, not an AI bot.
Then the investigation starts, which is where the real cost lives.
An engineer opens a tool and sees data that matters but isn't enriched. It shows a spike in activity, and that's it. The engineer can't speak to what the activity was, where it came from, or who was behind it, because either the tool doesn't have it or the engineer doesn't have permission to see it. Nobody can say which in the moment. Either way, precious time is ticking away.
The rest of the stack argues with itself. The cloud tools show one thing, the identity console shows another, the SIEM has the logs, and no one can put it together. Every piece of evidence exists. Nobody holds all of it at once.
Eventually, the team resolves it without incident, and it takes a lot of time and people.
Most teams score that as a win and file it, and the score hides the expensive part. Stopping the obvious was never the hard part. The hard part is an investigation that crosses nearly the entire infrastructure stack, where explaining what could have happened and proving conclusively what did or didn't happen takes far longer than finding the threat and remediating it.
That is the true cost. You can't skip paying it. Explaining what happened is how you craft the prevention actions and the process improvements that keep the next one from landing the same way.
In the age of AI, the adversary is learning faster than your team. An attacker who finds those credentials never has to reconcile three consoles or wait on an access request. Your team has to do both, on the clock, before anyone can say the word "conclusively" with a straight face.
You won't find those walls during an incident without paying for them in hours. You can find them on a quiet Tuesday for free.
So, here's the MondayMove
Take the last alert your team closed as probably nothing, hand it to one engineer, and have them prove what did or didn't happen using only the tools and access they hold today, logging each wall they hit and whether the tool lacked the data or the engineer lacked the permission.
Without conclusion, you can't be certain, and we are in a certain business.
Discussion