One concept / All phases
The house & the safe.
A mental model for an owner-authorized assessment. The house represents the environment, its openings represent exposed services, and the safe represents a specifically agreed valuable resource.
| House picture | Technical meaning | Important limit |
|---|---|---|
| House perimeter | Approved target scope | Nearby properties and third-party infrastructure are not automatically included. |
| Doors, windows, vents | Ports, services, endpoints | An open port means a listening service; reachability does not prove a flaw. |
| Door answers / locked / no response | Open / closed / filtered observations | Network filters and missing replies can obscure the result. This is an analogy, not an exact physical equivalence. |
| Rooms and corridors | Hosts, segments, reachable resources | A network route or visible resource is not proof of permission. |
| Keys and house rules | Identities, roles, delegated permissions | A key analogy simplifies tokens, ACLs and contextual authorization. |
| Upstairs restricted room | Higher privilege boundary | Privilege escalation changes effective permissions; lateral movement changes location. |
| Safe and contents | Agreed business objective and data | Seeing the safe, reaching it, opening it and accessing its contents are different outcomes. |
| Repair plan and recheck | Remediation and retesting | Confirm the weak boundary is fixed while legitimate access still works. |
Inspect the house from outside
Check the doors, windows, and ventilation openings. Which entry points exist, and which answer when checked?
Technical meaning: Map approved hosts, ports, services, and application entry points. An open port is an available service, not automatically a vulnerability.
Read the technical phase →
Test one entry point
Use an agreed simulation to show that one entry point lets the assessor cross the outer boundary.
Technical meaning: Validate a particular weakness with a controlled test. This may be unauthorized application access rather than a shell on a host.
Read the technical phase →
Map the rooms and corridors
Once inside—or starting from an agreed internal position—learn the layout, stairways, locked rooms, CCTV, alarms, and route toward the safe.
Technical meaning: Inventory the current identity, reachable networks, resources, and trust relationships. Seeing a room does not mean having permission to enter it.
Read the technical phase →
Cross an inner access boundary
Test whether a guest can obtain access reserved for the keyholder, such as entry to the upstairs safe room.
Technical meaning: Demonstrate a change in effective permissions. Reaching a different host is lateral movement; it is not necessarily an increase in privilege.
Read the technical phase →
Explain the route and repair the weak points
Show the homeowner which route was demonstrated, what protected the safe, and which doors or permissions need repair.
Technical meaning: Connect technical evidence to observed impact, prioritized fixes, and retesting. Reaching the safe room does not prove its contents were accessed.
Read the technical phase →
Apply the same house to different targets.
For Web, the doors are routes and API operations. For Mobile, the app is one doorway into a wider house that includes its backend. Platform testing examines the house structure, services and key system. IoT includes the connected fittings, firmware and cloud links. OT includes the machinery the house controls: a successful security assessment must preserve its operational constraints.
The metaphor explains security boundaries; it does not make real burglary part of the engagement. Physical entry, destructive actions and access to real sensitive data require their own explicit scope. Reporting need not wait until someone opens the safe.
Explore Web, Mobile, Platform, IoT and OT →