The quest for better pentest reports: Introducing Missing Security Controls

Maxime Nadeau, director of ethical hacking at GoSecure, presents Missing Security Controls, a way to report absent defences that CVSS scores as informational and customers therefore never fix. After a CVSS primer he lists its weaknesses: it strains in cloud-native contexts, has no metric for safety, clusters scores at 7.5, 7.8 and 8.8, invites gamification, and rates controls like HSTS inconsistently. A red-team story shows the gap: two physical intrusions, cloned RFID badges and a conference room with no network access control led straight to a mainframe, yet each root cause would score zero. He draws the line between a control and a vulnerability (a weak password policy versus a weak password found by spraying), and uses a browser-autofill credential-theft technique found by a colleague to show how one XSS yields recommendations for developers, web admins, security admins and architects. GoSecure's method strips impact from the CVSS formula and keeps exploitability (attack vector, complexity, privileges, user interaction, scope); the exploitability drop a control would cause, from 0.2 to 4.2, maps to low, medium or high. A calculator is public, and questions cover score distributions, CVSS versions, conflicting vendor reports and outreach to FIRST.