Three Questions Before You Touch Anything

The first look at a building usually turns up a long list. Old firmware. Shared passwords. A vendor login nobody remembers. Cameras talking to places they shouldn't.

The list feels urgent. It's also useless until you decide what comes first. Severity scores help, but they don't know your building. A flaw rated critical on a camera in an empty storage room can wait. A medium flaw on the reader at the main entrance can't.

Three questions sort the list.

1. What can it reach?

Can this device reach the access-control server? The video recorders? The building controls? A vendor's network? The internet? A device that can reach the systems that run the building moves to the top. A device boxed into its own corner moves down.

2. What breaks if it fails?

Would people get stuck outside? Would an emergency exit stop working the way it should? Would the cameras stop recording? Would an alarm stop reaching the people who respond to it? Would the heat or the air go down in a building full of staff? The bigger the answer, the more care the fix needs.

3. Can we change it safely today?

Is the fix one Findavi supports for this device? Has the owner said yes? Is there a quiet window to make the change? Is there a way back if it goes wrong? Do we know exactly how we'll check that the attack path is closed, and that the device still does its job?

If any answer is no, the fix waits. Keep watching the device and limit what it can reach in the meantime.

Core idea: Severity tells you something is wrong. What breaks if it fails tells you what comes first.

Ask your team: Which five devices in our most important building would cause the most trouble if they stopped working today?