Misconfigurations, privilege escalation, access controls, insider threats.
Open ports, network vulnerabilities, perimeter security weaknesses.
Firewall misconfigurations, intrusion detection/prevention systems.
Web apps, APIs, and mobile apps.
Operating systems, server configurations, and database security.