I've run enough penetration tests on small and mid-size companies to notice a pattern. Almost every engagement turns up the same three issues — before we even get creative:

1. Forgotten admin panels still on default credentials.

Someone spun up a staging environment two years ago, forgot about it, and it's still reachable from the public internet with "admin/admin" or a password that was never rotated.

2. Overly broad S3/storage bucket permissions.

Developers set buckets to "public read" to unblock themselves during a sprint, and it never gets locked back down. We regularly find customer data sitting in buckets anyone with the URL can access.

3. No MFA on anything that isn't the main app.

Companies lock down their production login but leave AWS consoles, admin dashboards, and internal tools protected by password-only auth. That's usually the actual way in.

None of these require a nation-state attacker to exploit. They require someone patient enough to look. If you haven't had a third party test your setup in the last 6 months, you probably have at least one of these right now.

We run monthly retainers for SMBs precisely because these issues creep back in — a scan today doesn't mean you're safe in 90 days. Happy to answer questions if you're thinking through your own security posture.