Thinking Like an Attacker

Security as a way of reading a system rather than a checklist bolted on at the end: what you are actually protecting, who you are protecting it from, where trust changes hands, and how to model a threat before it becomes an incident. Plus the honest economics of risk — what to fix, what to accept, and how to tell.