We break into companies every day. That is our business, and we are proud to field one of the best penetration testing teams in the world. Like real adversaries, our testers go after the weakest link. This year, we dug into the data from our testing to uncover the most common successful attack paths, with the goal of sharing actionable insights. We went back through the penetration tests our team ran in 2025, inside client networks, against their internet perimeter and against their web applications, and recorded every weakness we reported, every step our testers took and how far they got.
That let us answer a question most security programs never ask out loud: of everything we find, what actually gets an attacker in? The answer surprised even us.
of our internal tests reached a crown jewel, the data or systems that matter most
of our internal tests ended in a domain takeover
of those takeovers had no software vulnerability anywhere on the path
of takeover paths would have been broken by five changes
Patches were rarely the problem
Tap the chart to enlarge
Unpatched software is the weakness we report most often inside a network, in 78% of internal tests. It was on the path to a domain takeover in only 5%. Default SNMP community strings, fourth on that list at 56%, were on the path in 1%.
Meanwhile, weak domain passwords sit fifth on the reported list and on more takeover paths than any other weakness. Misconfigured certificate services, tenth on the reported list at 18%, was on the path in 16%, the one row in the chart where the two bars nearly match. The chart is sorted the way a scan report would sort it, and the blue bars show how little that order has to do with what decides the outcome.
Want to go behind the findings?
Live webinar · Thursday, November 12 · 2:00 PM ET (11:00 AM PT)
The findings are in, but what do they mean for your organization’s security? Join LMG Security’s Sherri Davidoff, Founder, and Tom Pohl, Director of Penetration Testing, as they walk through the attack paths behind the numbers and the five changes that could have prevented 94% of the domain takeovers our testers uncovered.
Five changes break 94% of takeover paths
Tap the chart to enlarge
Here is the good news. Every takeover in this report ran through something a security team can change, and none of the five changes waits on a vendor’s patch. Most cost staff time, not licenses.
The first one is probably already on your scan report. Scanners flagged the missing signing requirement in 76% of the internal tests they scanned. Organizations are not missing this weakness; they are not acting on it.
Also inside the report
- Why getting stopped short of Domain Admin isn’t the same as being safe. One internal test in four held a valid domain login and went no further, yet 45% of those still reached sensitive data.
- Why scanners see the problem and rate it harmless. Scans noted the protocols that poisoning abuses in 46% of the internal tests they covered, but flagged them as the poisoning weakness in only 4%.
- What happened when we tested the same organizations from both sides. More than twenty organizations, tested inside and out within about five weeks: no attempt from outside succeeded, and inside, our testers took control of the domain outright in four out of five.
- The web application flaw no scanner will flag. 45% of the web applications our testers got into never checked whether the person asking was allowed to see what they asked for.
- Eight real attack stories, step by step, including “The Printer That Owned a University.”
- A plan for 2027: what to keep funding, where to put the next dollar, and what to ask for in your next test’s scope.
If one laptop on your network were compromised tomorrow, how far could it get?
The full report shows the paths our testers took, the owner for each fix, and how to verify every change without waiting for your next test.
Download Patched and Still Breached
Prefer to hear it live? Register for the November 12 webinar with Sherri Davidoff and Tom Pohl.
About the data
This report analyzes the penetration tests LMG Security ran in 2025, inside client networks, against their internet perimeter and against their web applications. For each test we recorded every weakness we reported, every step our testers took and how far they got, so the findings reflect what actually enabled an attack rather than what a scan report lists first.
Findings from LMG Security penetration tests that began in 2025. Client-identifying details removed.
