The recent ASOS incident has got me thinking about a problem I’ve seen repeatedly over the years in penetration testing and security assurance.
We often define “critical” systems based on what customers can see.
- Payment page? Critical.
- Login page? Critical.
- Checkout process? Critical.
So that’s what gets tested.
The problem is that modern businesses are no longer powered solely by customer-facing applications. The systems sitting behind those applications often hold significantly more value to an attacker than the front-end itself.
Data warehouses, analytics platforms, customer insight tools, reporting dashboards, AI services, ETL processes, integration layers and cloud-native data platforms are increasingly where organisations concentrate their most sensitive information.
Yet these environments frequently receive a fraction of the security scrutiny.
The Hidden Attack Surface
I’ve lost count of how many times I’ve heard conversations along the lines of:
- “Can we test the payment page for under £1,000?”
- “Can we just do an unauthenticated test to keep the cost down?”
- “A vulnerability scan should be sufficient. That’s what last year’s pentest did.”
The discussion becomes focused on reducing scope rather than reducing risk.
Unfortunately, attackers don’t care how we’ve classified systems internally.
They don’t distinguish between “critical”, “non-critical” or “out of scope”.
An attacker is simply looking for the easiest route to valuable data, privileged access or business impact.
If a platform contains customer data, has access to production systems, stores credentials, runs automated processes, or acts as a trusted source for downstream applications, then it is part of the attack surface.
Whether it was included in the penetration test scope or not.
Security Doesn’t End at the Front Door
One of the most important questions organisations should ask is:
How do we know the security of the connections between systems?
Consider just a few examples:
- Snowflake → API → Customer application
- Analytics platform → Service account → Production environment
- AI chatbot → Data repository → Internal services
- Third-party integration → Privileged identity → Customer environment
- Reporting platform → Database credentials → Core business systems
Many organisations test the individual systems.
Far fewer test the attack paths that exist between them.
That’s where things become interesting.
A platform might have no critical vulnerabilities of its own, yet still provide a route into far more sensitive environments through trust relationships, credentials, APIs, integrations or misconfigured permissions.
The Risk Of Scope-Led Security
What concerns me most is that some security programmes become driven by budgets, compliance requirements or historical testing scopes rather than genuine threat modelling.
The result is often a narrow assessment that confirms what we already know:
- The login page isn’t vulnerable.
- The payment page isn’t vulnerable.
- The website isn’t vulnerable.
That’s useful information.
But it may tell us very little about whether an attacker can move from one trusted platform to another.
In many environments, the most interesting security questions are no longer about a single vulnerable application.
They’re about interconnected systems, excessive permissions, identity relationships and the ability to pivot through the environment.
The Lesson
The lesson I take from the ASOS story is not:
“Snowflake was hacked, therefore Snowflake is dangerous.”
At the time of writing, we don’t yet know the complete attack path or all of the facts.
The real lesson is much broader.
Stop defining criticality by what the customer sees.
Define it by:
- The data it contains.
- The access it provides.
- The trust relationships it holds.
- The systems an attacker can reach from it.
- The business impact if it were compromised.
Because if we have never tested those connections, those integrations and those pathways between systems, then we don’t really know how secure they are.
And increasingly, that’s exactly where attackers are looking.
About the Author
Tim Holman is CEO and Founder of 2-sec.
Having led assessments across public sector, financial services and enterprise environments, Tim has seen first-hand that many successful compromises do not occur because organisations fail to identify critical assets. They occur because organisations underestimate the importance of everything else.
His work focuses on identifying the blind spots that exist between vulnerability management, security monitoring, architecture and operational reality, helping organisations understand how attackers actually move through modern environments rather than how defenders expect them to.