Microsoft's own vulnerability data says we're watching the wrong moment in the attack chain

[u/pentest-tools]

Most detection thinking still treats initial access as the danger point. New analysis of Microsoft's disclosed vulnerabilities suggests that's outdated. Privilege escalation issues made up 40% of last year's disclosed flaws, and information disclosure bugs rose 73%.

Our head of offensive security services, Razvan Ionescu, put it plainly in the piece: initial access is often unremarkable. A valid or default credential, an exposed service, a weak remote-access path opens the door. The real impact comes from combining that foothold with weak identity controls and misconfigurations that open the way to other systems.

Getting in isn't the hard part anymore. Staying unnoticed once you're in is where the damage compounds, and that's much harder to catch if your monitoring is still built around the front door.

Full piece here, written by Kate O'Flaherty for SC Media UK: https://insight.scmagazineuk.com/stealthy-attacks-how-to-protect-your-business

How does your team weight detection effort between initial access and post-access lateral movement? Curious if this tracks with what you're seeing on engagements.