Reading a system for its failure points

01Reading, not scanning

Tools enumerate. They are good at it, and there is no serious review without them: they list what is exposed, what is outdated, what is configured against its own documentation. But an enumeration is an inventory, not an understanding. A tool does not know what the system is for, what the organisation believes about it, or which of a hundred flagged items sits on the path to the thing that must not happen. That knowledge comes from reading: taking the system as a text with an author, written over years by people with deadlines, and asking of every part the reviewer's question. What did they intend here, what did they actually build, and how wide is the gap.

The gap between intent and implementation is where every finding of consequence lives. Nobody intends the flaw. Somebody intends the shortcut, the temporary exception, the fix that would be revisited later. The reviewer reads for the places where later never came.

02Where systems actually fail

After enough reviews the geography becomes familiar. Systems rarely fail in the middle of a component, where one team owns the problem and the logic is dense and tested. They fail at the boundaries between components, where each side assumes the other is validating, checking, filtering, and neither is. They fail on assumptions nobody wrote down: the service that was always going to be internal, the input that would never exceed a size, the user who would never be hostile. They fail along the path nobody believed was reachable, which an attacker finds precisely because nobody guarded it. And they fail through privilege that accumulated quietly over years: accounts that outlived their owners, access granted for one project and never withdrawn, credentials copied into places nobody remembers.

None of these appears in an inventory as a defect. Each is visible to a reader who asks what was assumed, and then checks whether the system still matches the assumption. Most do not. Systems drift; assumptions stay where they were written, which is usually nowhere.

03A report with two readers

A review is worth what its report changes, and the report has two readers with different needs. The first is the person who has to fix things. For that reader, a finding must be exact: where it is, how to reproduce it, what it takes to close it, and in what order the closing should happen. Order is the report's real contribution. Findings are ranked by consequence, by what each one could actually cost the organisation, not by count or by the severity grade a tool assigned in ignorance of context. Twenty trivial findings do not outrank one quiet path to the record that must not be altered.

The second reader arrives later, sometimes years later: an examiner, an insurer, a counterparty, a tribunal, reconstructing what the organisation knew and when. For that reader, the report must be dated, specific about what was in scope and what was not, and written so that each finding can be verified without its author in the room. A review written only for the first reader is half a review. The second reader is the one in front of whom the organisation's diligence will one day be measured.

Reproducibility is what separates a finding from an opinion. Each finding records what was observed, from where, under which conditions and with which access, so that the person fixing it can watch it happen and the person examining it later can confirm that it did. A finding that cannot be reproduced invites negotiation, and teams negotiate with opinions; they act on demonstrations. The same discipline settles the argument the report will start inside the organisation, because it always starts one. The evidence is in the text, dated, and independent of whoever wrote it down.

04Before the incident

Every consequential system gets read closely at least once. The only open question is by whom, and when. Done before the incident, the reading is a review: conducted on the organisation's terms, on its schedule, with its interests held by the reviewer, and followed by quiet corrections nobody outside ever hears about. Done after, the same reading has other names, other authors and other audiences, and the organisation attends as a subject rather than a client. The findings are broadly the same either way; the boundaries, the unwritten assumptions, the unguarded path were all there to be found. The difference is who found them first, and everything of consequence follows from that difference.

This is the whole argument for the method. Not that reading finds more than scanning, though it does, but that the reading which matters is the one done early, by a reader on your side of the table.