The Pentest Finding That Shows Up in Almost Every Small-Business Engagement

If you want to know what actually puts a small business at risk, don't look at exotic attack chains. Look at what shows up over and over across real engagements. For small-business assessments, that's default or weak credentials, left on admin panels, network gear, and internal services that were installed, configured once, and never touched again.

Where it actually shows up

It's rarely the primary website or customer-facing app. Those tend to get at least some attention. It's the router admin page still on the factory password. It's an internal dashboard or management tool installed by a vendor during setup, with credentials that were never rotated because nobody was ever assigned to rotate them. It's a service that was spun up for a one-time task and quietly kept running.

Why it keeps happening

This isn't a sophistication problem. It's an ownership problem. Something gets installed, often by a vendor or contractor doing a specific job, and once it works, everyone moves on. Nobody owns the step that comes after 'it works': hardening it, rotating the default credentials, adding it to an inventory so someone actually knows it exists. Small businesses rarely have a security review built into their deployment process, so nothing catches it until an assessment does, or until someone else finds it first.

Why it's not a hard fix

The technical fix, once you know about it, is trivial: change the password, close the exposed interface, done. That's exactly what makes this finding frustrating rather than impressive: it requires no clever exploitation, no chained vulnerabilities, just someone checking. Which means it's also one of the cheapest risks a small business can eliminate, if the process gap gets closed instead of just the individual instance.

The actual fix isn't more tools

Buying another security product doesn't fix this. What fixes it is a basic asset inventory (knowing what's actually running and internet-reachable) plus a real credential rotation habit, and a re-check step that happens periodically, not just once at deployment. That's process, not technology. It's also exactly the kind of unglamorous work that keeps showing up unfixed, because it's nobody's job by default.