A vulnerability only matters if it changes what becomes reachable.
That idea isn’t new. It’s embedded in decades of adversarial thinking.
But most workflows still treat vulnerabilities as endpoints rather than starting points.
We scan.
We classify.
We prioritize.
And then we stop.
You might say we already account for reachability.
It’s not attack graphs.
It’s not Zero Trust.
It’s not threat modeling.
It’s not red teaming.
Those approaches address pieces of the puzzle:
- Attack graphs model theoretical paths.
- Zero Trust constrains access.
- Threat modeling anticipates risk.
- Red teams demonstrate impact.
But they all leave open the question that ultimately determines consequences:
> What does this enable?
Not in theory.
In context.
Because the difference between noise and catastrophe is often just one reachable transition.
Security has gotten very good at identifying weaknesses.
We’re still catching up on understanding their consequences.
Security · Writing