Token theft, unpatched systems, external exposure, and AI use, and how to talk about each one with someone who isn't technical
When a security assessment is working, each report should be shorter than the last one. Something gets found, someone fixes it, and that finding doesn’t come back.
Two things tend to get in the way of that. The first is findings that stay put. I’ve reviewed hundreds of assessment reports, and I still find machines running Windows 10 after it reached end of support, a few even still on Windows 7, and vulnerabilities a single patch would close. When I look at the same organization across several reviews, a lot of those same patches are still sitting there.
I don’t say that to knock anyone, since patching competes with every other request and the people responsible for it are usually stretched thin. But when a finding shows up three reviews in a row, something other than the technology is in the way, and that deserves its own conversation.
The second problem is quieter. Risk conversations tend to settle on the most striking finding and stay there. Cracked passwords are a classic example. They’re concrete, they’re personal, and nobody needs a glossary to understand them. In a well-run environment, though, that finding should be temporary. Clearing saved passwords out of browsers and blocking new ones takes a script and a few policy settings, and once that’s done, a conversation built around it runs out of things to say.
So whether you’re delivering the assessment or receiving it, ask what you’d talk about if the most striking finding disappeared tomorrow. A useful risk conversation covers the whole picture, from the findings that keep coming back to the ones that rarely get discussed. That picture starts with how attackers are getting in right now.
Why Readouts Need More Than Passwords
Credentials still matter, and they belong in the readout. In the 2026 Verizon Data Breach Investigations Report, credential abuse shows up in 39% of breaches, more than any other technique. But exploiting a vulnerability is now the most common way attackers get in, at 31% of breaches, while stolen credentials as the first step dropped to 13%.
A readout built around passwords alone describes one door in a building that has several. Three other findings deserve a spot no matter what the report turns up, and there’s a fourth that everyone already knows is coming. For each one, a useful readout covers what it is, why it matters, what fixes it, and how to explain it to someone who isn’t technical.
Token Theft and the Login That Was Already Approved
Token theft tends to get skipped in readouts. It sounds technical, and a client who just rolled out MFA usually assumes the problem is solved.
When you sign in to something like Microsoft 365 and pass MFA, your browser gets a token. Think of it like a wristband at a concert. You show your ID once at the door, and after that the wristband gets you back in. If someone steals the wristband, they skip the line. Microsoft puts it this way: replaying a token from an account that already completed MFA “satisfies the validation of MFA.” MFA did its job, and the attacker showed up after it.
Microsoft reported that Tycoon2FA, a phishing kit sold as a service, was reaching more than 500,000 organizations a month this way before it was disrupted. Phishing-resistant MFA, like security keys or passkeys, makes the trick far harder, and managed devices and shorter sessions limit how long a stolen token stays useful. After a compromise, revoke sessions along with resetting the password, since Tycoon2FA access survived password resets when sessions were left alone.
In the readout, start with the wristband, then say plainly that MFA still matters, then walk through the controls that make a stolen wristband hard to use. A client who hears that their MFA rollout was the right call is more open to the next recommendation than one who walks away thinking it didn’t work.
Unpatched Systems and the Finding That Keeps Coming Back
This is the one I mentioned at the top, and it’s the one I see more often than any other. It’s also easy to deliver badly, since by the third review in a row it can start to sound like an accusation.
It covers missing updates on operating systems, applications, and security tools, plus systems the vendor no longer supports, like those Windows 10 and Windows 7 machines. The fix almost always exists, and getting it applied is the hard part. According to the 2026 DBIR, only 26% of the vulnerabilities on CISA’s Known Exploited Vulnerabilities list, the ones attackers are already using, were fully remediated in 2025, with a median of 43 days to get there.
Start with that known-exploited list. Give patching a clear owner and a deadline, shorter for anything facing the internet, and keep a replacement date for anything past end of support. When something can’t be patched, write down why and what’s covering for it.
The most useful thing you can bring to this conversation is a timeline. Put the same finding from three reviews side by side and you won’t have to say much. Then ask what’s getting in the way. Usually the answer is time, ownership, or worry about breaking something that works. Those are business problems, and the person across the table can help solve them. That’s a better conversation than “you didn’t patch.”
External Exposure and What the Internet Can Already See
External findings often get folded into the patch list, but they deserve their own slot in the readout because they don’t depend on anyone clicking anything. If a firewall, VPN, remote access tool, or web application is reachable from the internet, anyone can try it.
VulnCheck found that edge devices like firewalls, VPNs, and proxies were the most targeted technologies of 2025. In February 2026, CISA ordered federal agencies to replace edge devices that no longer get security updates, and the reasoning applies to anyone with a ten-year-old firewall in the closet.
Know what’s exposed, check it from the outside on a regular schedule, and take anything off the internet that doesn’t need to be there. Patch edge devices first, replace equipment past end of support, and put MFA on remote access paths, vendor accounts included.
For a non-technical audience, I like to describe this as the part of the business that faces the street. Anyone walking by can try the door handle. Specifics help here, too. “Your remote access appliance is two versions behind, and the vendor has already released a fix for a flaw that’s being exploited” lands better than a severity score.
AI Use and the Three Questions to Ask
We have to talk about AI. A risk conversation that skips it right now leaves something out.
The 2026 DBIR found that 45% of employees now use AI regularly on work devices, up from 15% a year earlier, and 67% of them sign in with personal accounts. IBM’s 2025 breach research found that high levels of unsanctioned AI use added about $670,000 to the average breach cost.
Banning AI outright rarely holds up. The useful conversation is simpler than that: which AI tools are in use, which accounts people sign in with, and what data goes into them. In the readout, ask those three questions out loud and let the client answer. Plenty of organizations can’t answer all three yet, and that’s a good place to start, since whatever they can’t answer becomes the first item on the plan.
What Each Environment Teaches You
I’ll add one more thought, mostly for those of us who have these conversations for a living. Every environment teaches you something, whether it’s an odd configuration, a finding that caught people off guard, or a fix that turned out easier than expected, and each one becomes a story you can use the next time you explain risk. Stories tend to stick in a way statistics don’t, and comparing notes with peers who see different environments fills in the picture faster than any one person can.
If you’re on the receiving end of an assessment, ask the people doing it what they’re seeing elsewhere. That context is often the most valuable part of the conversation.
Turning Findings Into Fixes
Findings are supposed to be temporary, and the striking ones will come and go. What lasts is the ability to look at the whole picture and explain why each part of it matters in plain language.
Each finding here needs something a little different in the readout. A stolen session needs an analogy, a patch that keeps coming back needs a timeline, an exposed firewall needs a version number, and AI needs three questions asked out loud. The goal behind all of them is the same, a client who leaves the room knowing what the risk is, what fixes it, and who’s going to do the work. That’s what keeps the next conversation worth having.
So whether you’re delivering the assessment or receiving it, pull your most recent one and find three findings that never made it into the discussion. Start there.
In this month’s SecOps, “Five Things You’re Getting Wrong During Your Readouts,” we’ll walk through how to turn findings into conversations that get them fixed. Galactic partners can save their spot here.
