infosec: a subject where many of us in the trenches know the avenue of attack, there's no real reason WHY that avenue is open. The only thing holding you back as a consummate professional is bureaucracy and office politics. Because of that, you say your piece, cover your ass and say called it under your breath during the incident response bridge.
XFEDI
ActivityPubConversation
examples:
why does clickfix still work? Because all of your users have access to powershell and none of them need it. Also, all of your users have access to the run prompt, and in this case they have absolutely no need for it (the vast majority not even knowing it existed before that totally legit cloudflare notification popped up, asking them to open it)
Why do reverse shells and other random bullshit traffic on seemingly random ports, including SMB traffic still work for payload delivery? because egress filtering was never, and will never be implemented because it gives the executives bad vibes.