Recommended Free Tools
Thinking like an attacker helps an organization find plausible routes to its important systems before a real adversary does. It strengthens resilience when that perspective is grounded in accurate visibility, used to prioritize defenses, tested only with authorization, and connected to detection, response, and recovery—not treated as a substitute for them.
What attacker-informed thinking means
In a TechRadar Pro opinion article published on 11 September 2026, Justin Henkel, identified there as CISO at SolarWinds, argues that security leaders should understand their own environments and reason backward from how those environments might be attacked. The practical question is not simply whether a control exists, but whether an adversary could reach a valuable asset through a combination of weaknesses in technology, processes, or people.
As an Amazon Associate I earn from qualifying purchases.
Henkel emphasizes visibility into assets, system relationships, and normal behavior. He explains the distinction this way: visibility tells defenders what is happening; observability provides context for understanding why. His line, “you cannot defend what you cannot see,” is an argument for knowing what is present and connected—not a claim that visibility alone prevents compromise. Read Henkel’s article at TechRadar Pro.
How to trace a plausible attack route
Begin with a business-critical service or asset, then work backward: what would an attacker need to access it, and where could that chain begin? Keep the exercise tied to the organization’s actual environment rather than a generic list of threats.
#1 Best Overall
- Choose the outcome that matters. Identify a service, data set, or operational capability whose loss or compromise would materially affect the organization.
- Map dependencies and access. Record the relevant assets, identities, people, processes, networks, cloud services, and connected technology. Include how systems and accounts relate to one another.
- Consider possible footholds. Ask what could give an adversary an initial entry point, and what assumptions defenders are making about access, configuration, or normal activity.
- Trace movement toward the target. Follow plausible links across technology, people, and processes. Note where existing controls could prevent, detect, or slow that route.
- Check the evidence. Separate observed conditions and authorized test results from assumptions. A credible route through the organization is more useful than a generic threat description.
- Decide what to change and verify it. Prioritize proportionate controls, assign owners, and establish how defenders will know whether the change works.
This is a practical synthesis of Henkel’s attacker-route approach and NIST’s risk-management framework, not a prescribed penetration-testing procedure.
Turn the exercise into a resilience cycle
NIST Cybersecurity Framework (CSF) 2.0 organizes cybersecurity outcomes under six functions: Govern, Identify, Protect, Detect, Respond, and Recover. NIST describes these functions as concurrent: Govern, Identify, Protect, and Detect activities should happen continuously, while Respond and Recover capabilities should be ready and activated when incidents occur. The framework organizes risk management; it does not mandate a particular attack simulation or guarantee resilience. CSF 2.0 was published on 26 February 2024. See NIST’s CSF 2.0 resources.
| CSF function | How it supports attacker-informed resilience |
|---|---|
| Govern | Set priorities, clarify accountability, and establish who owns cyber risk. |
| Identify | Understand important assets, services, dependencies, and normal activity. |
| Protect | Apply safeguards to the routes and assets that matter most. |
| Detect | Monitor for suspicious deviations and make it possible for staff to report them. |
| Respond | Prepare to contain an incident, communicate, and coordinate action. |
| Recover | Restore affected services and use lessons from incidents or exercises to improve. |
NIST’s CSF FAQ describes the framework as a high-level method to set enterprise objectives, identify and protect key resources, and collaborate on plans to detect, respond to, and recover from incidents. Read the NIST CSF FAQ.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTest assumptions safely and use the results
Henkel reports that internal and external teams at his organization conduct product, enterprise, spear-phishing, and physical penetration testing. That is an account of one organization’s practices, not a recommendation that every organization perform every type of test. The appropriate scope depends on authorization, expertise, disruption risk, and the capacity to fix what testing uncovers.
Rank #3
Any assessment should have explicit permission, boundaries, and a plan for handling findings. Testing can reveal whether a suspected route is feasible and whether controls work as expected; it should lead to assigned remediation and follow-up rather than a report that sits unused.
Ethical hacking is also a learning area, not a license to test systems without consent. The University of Illinois Critical Infrastructure Resilience Institute describes a CISA-funded curriculum that includes ethical hacking, vulnerability assessment and mitigation, and incident-response education. Explore the CIRI cybersecurity curriculum.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prepare for incidents, including ransomware
Resilience includes what happens after prevention fails: detecting an incident, containing its effects, communicating, restoring services, and improving from the experience. NIST’s ransomware community profile maps CSF 2.0 outcomes to ransomware risk management; its final publication date was 11 June 2026. It is a way to organize relevant outcomes, not evidence that any single practice guarantees protection. Read NIST IR 8374 Rev. 1.
Henkel also asserts that AI and automation may compress the time between vulnerability discovery and exploitation to “minutes – seconds, even.” The article does not provide a named dataset or methodology for that timing, so it should be read as his warning rather than as a verified general statistic. The practical case for preparation does not depend on that figure: organizations need workable detection, containment, communication, and recovery capabilities.
Quick Recap
Best Value
Questions that keep the work practical
- Which assets and services matter most to the organization?
- What identities, dependencies, and processes could provide a path to them?
- Which parts of the proposed route are evidenced, and which remain assumptions?
- What control would interrupt or reveal the route, and who owns the fix?
- Can the organization detect, contain, communicate, and restore if the route succeeds?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
