Attacking is easier than defending
A lab is not production
In 2025 and 2026, I took OffSec’s PEN-200 course. I have no certification to claim at the end of it: it is a course, not an experience. The Hack The Box labs were the practice ground.
What the course changed is not a skill I can tick on a CV line. It is a way of reading a system, through its entry points and its versions. The course did not make me faster at breaking something. It made me slower at trusting a configuration.
A flaw is never alone
In the lab, I could compromise any kind of web application, different protocols, Linux and Windows operating systems, and Active Directory. No pentest was run in production, and no client system was touched.
What the course teaches is that the entry flaw is never the goal: it gives a first access, then you look for an RCE, then a privilege escalation, then admin rights on the machine, then those of the domain. The path does not rest on luck: it rests on method and on the time spent on it.
I loved it.
In production, I look at versions before attackers
At Back Market, Renovate merged minor and patch updates automatically. Major versions stayed a manual decision, and dependencies that move together were grouped into a single pull request. At UKG, then on my current projects, Dependabot held that role from 2020 to 2026.
I look at the OWASP Top 10, and I patch fast as soon as a security fix ships. Configuring Renovate and Dependabot is work in itself: enough automation not to be blocked when the fix lands, without going through a specialised provider whose cost is not justified on my projects. A minor update that breaks production costs more than the one it fixes, which is why major versions keep a manual decision. It is not spectacular security. It is background work, and it is hard to demonstrate.
An update you put off long enough ends up being a decision. I can say it is in place and that it runs without me.
Configuration, not the attacker
The real danger is not the attacker. It is configuration and missing updates, which is to say forgetfulness and the little time or attention of the people who administer and deploy.
At Jaccede, between 2015 and 2020, Sentry was the only instrumentation. No metrics, no alerts, no SLO, no SLA. An error was discovered once the user had been hit. The cycle that followed was regular: a 5xx arrived by email with its traceback, became a ticket, was fixed, then marked resolved to close all its occurrences. It started after the incident. The problem was not the tool. It was the moment it spoke.
On Medical Appointment, in 2026, configuration moved out into a dedicated repository, with Helm charts and ArgoCD. An environment deploys reproducibly, with no homegrown script. On Interview Challenger, in 2025 and 2026, the production deployment waits for human approval, images are tagged by SHA and the CI has seven jobs. At UKG, from 2020 to 2024, the legacy Python stack stayed in place: Elasticsearch went from version 1 to 8 with the functional contract unchanged, without rewriting the product.
In each of these cases, the work was not to push back an attacker. It was to reduce what stays open through forgetfulness. Configuration and updates are decisions, not events.
What I do not know
No drop in incidents has been measured for the update policy. I have no figure to offer anyone asking whether it protects anything, and I prefer to say so before I am asked.
The fragility I observed in the lab remains an observation. I have neither a sample nor a measurement, and I do not turn what I saw on those machines into the state of the fleet.
I have not run the pentest, and the course does not replace that experience.
Attacking is easier than defending.