From Flaw to Weapon

## What a precondition actually is A precondition is the state of the world that must already hold before an exploit's first instruction runs. The common ones are short and familiar: the attacker needs an account on the system, needs to be running code on the host already, needs a person to click something, or needs to be on the same network segment as the target. There are two ways to read that list, and only one of them is right. **The wrong reading is a difficulty scale.** Under this reading, preconditions are obstacles stacked in front of the flaw: three preconditions is harder than one, and harder means lower risk. This produces the classic backlog sorted by precondition count, where "unauthenticated, no interaction" floats to the top and "authenticated, local" sinks whether or not anyone has checked what those words mean in this particular estate. **The right reading is a coordinate.** A precondition names the stage of an intrusion at which the flaw becomes usable. "Requires a valid account" does not say the attack is hard; it says the flaw belongs to the phase after initial access. Since initial access is a thing adversaries do routinely, for a living, all day, that placement is a description of *when* the flaw pays out, not a claim that it never will. ## The population test The test that converts the coordinate into a real judgment is a single question: **who already holds this position?** Enumerate them honestly: - Every employee and every contractor with a directory account. - Every customer, if the product is multi-tenant and self-service. On a system anyone can sign up for with a credit card or a free trial, "requires authentication" describes the entire internet with one extra minute of work. - Every service account, including the ones whose credentials are checked into a repository or baked into an image. - Anyone holding a credential obtained by phishing, by reuse against a breach corpus, or by purchase. Working credentials are among the cheapest things an adversary can acquire, which is precisely why credential theft is such a large share of real intrusions. - Anyone holding a live session or token, which is not the same population as "people who know a password". If that enumeration returns thousands of principals, the precondition is not a barrier. It is a formality, and the honest severity of the flaw is close to what it would be with no precondition at all. ## Authenticated is not trusted A related confusion sits underneath the wrong reading: treating "authenticated" as a synonym for "an insider we vetted". Authentication proves that a credential was accepted. It does not prove who presented it, and on a self-service product it does not even imply an employment relationship. A flaw reachable by any authenticated principal on a multi-tenant system is reachable by any attacker willing to become a tenant. ## What the precondition does legitimately tell you It is not noise. Read as a position, it tells you three useful things: 1. **Which actors can use it.** A flaw needing physical presence in a locked facility genuinely does exclude most of the world. A flaw needing an account excludes almost nobody on a public product and quite a lot of people on an air-gapped one with four operators. The same wording carries different weight in different estates, which is the whole point. 2. **The shape of the attack.** A required preceding step means the technique cannot be fully self-driving; something has to supply the position first. That constrains how the attack composes with others. 3. **Where a chain can be cut.** Choosing the control class that removes a precondition is a separate discipline with its own substitution test, and it is not this question, but the precondition is the input to it. ## Preconditions compose, so ranking in isolation hides chains The most expensive version of the mistake is rating each entry alone. An unauthenticated flaw that yields a low-privilege account is often rated moderate because it grants "only" a weak account. An authenticated flaw that yields administrative control is rated moderate because it "needs an account". Chained, they are one unauthenticated path to administrative control, and no single row in the list says so. Preconditions are the joints where findings snap together; a list sorted by precondition count is exactly the list that makes those joints invisible. ## Saying it in an interview The answer an interviewer is listening for is the reframe plus the test: a precondition is a position in the intrusion rather than a barrier in front of it, so name the population that already occupies that position, and let the size of that population drive the judgment. Then add the honest caveat, which is that preconditions do matter in estates where the position is genuinely scarce, and that telling those two cases apart is the actual skill.