content: If you knew how easy it was to break into something youd be amazed.  No, I wouldn't be.  I'm blue team, and I KNOW how bad we have it. But they won't let me fix any of it.  It's not even to the point of educating the users and getting them to pay attention, let alone care.  The big problem is the IT people who have IT skill sets twenty years out of date, if they know anything about IT at all.  Lateral hops?  Dude half the IT team at a problem client uses domain/enterprise admin group member accounts as their primary user accounts because feel like it's a status symbol.  There are no lateral hops - just get one of them to open any kind of exploit, and you own the authentication infrastructure.