The Jester was found in the corridor, counting. “Don’t stop me,” he said. “I’m doing security.”
Last spring they sent a man round the castle with a list. Every door, every window, every gate, and beside each one he wrote down whether it was locked. It took him a morning. He found forty-one doors, and eleven of them weren’t locked at all. This surprised everyone except me, because I use four of them.
That’s a vulnerability scan. A man with a list walks the walls and writes down what looks wrong. He doesn’t open anything. He doesn’t go in. He hands you the parchment and says, “These eleven are a problem.”
Fair enough. But the list said the pantry door was unlocked, and nobody asked the better question: what happens if someone walks through it?
I can tell you, because I did. Through the pantry, up the servant stair (nobody watches the servant stair), along the gallery, and into the room where they keep the seals. Eleven minutes. I signed a decree ordering more wine and left it on the table. It was honored.
That’s a penetration test. It isn’t a list of unlocked doors. It’s a demonstration of where an unlocked door leads.
Here’s what the clever men missed. On parchment, all eleven doors looked equally bad. In truth, ten of them opened onto a corridor with a guard in it. One opened, by way of a stair nobody watches, into the seal room. The list couldn’t tell them which was which. Only walking it could.
So these are two different errands, and neither replaces the other. The scan is cheap, so do it often. A man with a list can check forty-one doors before lunch, every week, forever. The test is slow and dear, so do it less often, because it needs someone with imagination, and imagination costs.
The scan asks: what’s unlocked? The test asks: and then what?
Do only the scan and you’ll own a tidy list of problems and no idea which one ends with a jester ordering wine in the king’s name. Do only the test and you’ll pay a fortune to learn about doors a list would have found for pennies.
They barred the pantry the next morning. Fine bar, too. I’m writing this from the laundry.
