Part 2: A Vulnerability Is Often Just the Beginning

Sat, 24 Oct 2026 00:00:00 +0000

When we identify a security issue, it’s natural to focus on the bug itself: what is vulnerable, how it can be exploited, and how to fix it. These are important questions, of course, but they don’t tell us how bad the consequences could be. For that, we need to understand the application, its permissions, the data it handles, and what an attacker might be able to do after exploiting the weakness.

That’s a useful distinction to make when assessing risk. A vulnerability can be an isolated problem with limited consequences, or it can become the starting point for a broader compromise. The same type of vulnerability can present very different levels of risk depending on the surrounding context.

Part 1: When Your Software Is Open to the World

Wed, 21 Oct 2026 00:00:00 +0000

When it comes to security, there are a lot of things I’d love to have known when I started my career as a software engineer. Now, as an engineer focused on cybersecurity, there are things I’d like my product engineering colleagues to know.

There are books, videos, and other resources out there that can teach you about vulnerabilities, what they are, and how they can be exploited. Others teach tools and methods for scanning code, finding vulnerabilities, and fixing them. Some of these resources, usually the good ones, bring more than just technical expertise. They help develop an adversarial way of thinking, which is fundamental to understanding where weaknesses might exist, how attacks can happen, and how far they could go.

This post is the first in a series where I want to share some habits and perspectives that can help software engineers develop a strong security mindset.

security mindset on Deployment

Part 2: A Vulnerability Is Often Just the Beginning

Part 1: When Your Software Is Open to the World