How attackers actually get in

Nobody is port-scanning your laptop. Real intrusions come through the things you expose to the internet, the credentials your people type, and the software they download. If your remediation queue is not ordered around those three doors, it is ordered around the wrong thing.

A question I see constantly from people new to security: how does someone hack a personal computer remotely? The honest answer is that, mostly, they don't — not directly. And the reason why is the most useful thing a small security team can understand about where to spend its time.

Your laptop is not listening

To attack a machine over the network, something on it has to be accepting connections. A typical laptop is not hosting anything. It sits behind a home router or an office firewall doing address translation, it initiates connections outward, and it answers nothing that was not asked for. There is no door to knock on.

So attackers do not go looking for a door on the endpoint. They get the endpoint to open one from the inside, or they skip the endpoint entirely and go after something that is listening. In practice that comes down to three routes.

The three doors

• What you exposeWeb applications, VPN concentrators, firewalls, remote-access gateways, file-transfer appliances, mail servers. These are built to accept connections from strangers, which is exactly what makes them the target. An unpatched flaw on an internet-facing device is the shortest path into most networks.
• Who you trustStolen, reused or phished credentials. A valid username and password into a VPN, a cloud console or a mail tenant does not look like an attack to anything watching — it looks like an employee logging in.
• What you downloadPhishing attachments, fake download pages, poisoned packages and repositories, compromised legitimate websites. All of these get the user to run the attacker's code themselves, which is how the “not listening” problem gets solved from the inside.

Notice that the third door often depends on the first. A legitimate website that gets compromised can be quietly turned into a distribution point for whatever its visitors came to download. The site owner's unpatched server becomes everyone else's infection. Your exposed systems are not only your risk.

What this means for your scan report

Here is where it gets practical. A vulnerability scan of a mid-sized environment returns thousands of findings, sorted by CVSS. CVSS measures how bad a flaw would be if exploited. It says nothing about whether the flaw sits on a door.

A critical on an internal print server and a critical on the VPN gateway carry the same score. They are not the same risk. One is reachable by anyone on the internet; the other requires someone to already be inside. Working the list top-down by severity treats them as equal, and that is how teams spend a quarter closing internal findings while the edge device that actually gets exploited sits in the backlog.

Reorder the queue around the doors instead:

• 1. Internet-facing, known exploitedAnything on an exposed system that appears in CISA’s Known Exploited Vulnerabilities catalog. This is not theoretical risk; someone is already using it. Days, not sprints.
• 2. Internet-facing, likely to be exploitedA high EPSS score on an exposed asset. The flaw is not confirmed in the wild yet, but the probability model says it is headed there.
• 3. IdentityMFA gaps on anything reachable from outside, especially remote access and email. Shared and stale accounts. This is not a scanner finding at all, which is why it is so often missed.
• 4. The endpoint fleetBrowser, office suite, PDF reader, anything that opens files from strangers. This is where the third door lands.
• 5. Everything elseInternal-only findings with no exploitation signal. Still real, still scheduled, but behind the four above.

None of this needs a new platform. It needs two columns your scanner did not give you — is it exposed, and is it being exploited — and the discipline to sort by them before severity.

Doing it without buying anything

The exploitation half is free. CISA publishes the KEV catalog, FIRST publishes EPSS scores daily, and both are public. The scan triage tool on this site takes a Nessus, Tenable, Qualys or similar export, matches every finding against both, and re-ranks it — entirely in your browser, so the scan never leaves your machine. That gets you the “is it being exploited” column in about thirty seconds.

The exposure half you have to supply, because no scanner knows your network as well as you should. A short list of what faces the internet — and if you cannot produce that list from memory, producing it is the first remediation task, ahead of any patch.

The honest limits

Two caveats. First, “internal only” is a weaker guarantee than it sounds; once someone is through any of the three doors, internal findings become the path to everything else. Prioritising the edge does not mean ignoring the inside, it means doing the edge first.

Second, a scan only sees what it was pointed at and what it could log into. An uncredentialed scan reports versions it guessed from a banner, and the system nobody remembered to include never shows up at all. The prioritisation above is only as good as the inventory underneath it.

That is usually where the real work is. Most environments I see do not have a patching problem. They have a knowing what they have problem, and the patching problem follows from it.