You'd be amazed at how easy it is to exploit internal tools once you're inside someone's network. Internal tools were the juiciest targets: a perfect storm of "created by an unqualified team that no longer works here" and "nobody realized it's still been running for a year."

It can work, but evidence seems to imply this strategy makes the situation worse. I'm not sure what to do with this information other than to relay the experience. It's one of those tricky counterintuitive facts.

Oh, definitely agree. But I'm talking about "internal" tools that aren't actually internal, but are exposed on the public internet. At least if they're behind a VPN there's a hurdle to jump before you get to those tools.