You'd be amazed at how easy it is to exploit internal tools once you're inside someone's network. Internal tools were the juiciest targets: a perfect storm of "created by an unqualified team that no longer works here" and "nobody realized it's still been running for a year."

It can work, but evidence seems to imply this strategy makes the situation worse. I'm not sure what to do with this information other than to relay the experience. It's one of those tricky counterintuitive facts.