Audit real permission defects - and the modes that only look like defects
Most unauthorised access is a permission nobody tightened rather than a bug anybody exploited. Each scenario gives you the output of a real audit and asks the two questions that matter: which entries can an attacker actually act on, and which are correct and must be left alone. Getting the second one wrong is how an audit loses its audience.
A researcher retrieved a database credential from a loan company's public web server. Audit the document root, separate the four real permission defects from the two modes that only look alarming, and choose a fix that actually closes the exposure.
Payroll data on an NTFS share turns out to be reachable by every domain user. Work through icacls output, inheritance flags and the share-versus-NTFS intersection rule to find which ACE is actually granting the access.
Nightly database dumps keep coming back world-readable no matter how often the directory is tightened. Read the unit file, the umask arithmetic and the POSIX ACL mask to work out why the directory was never the problem.
No exploit, no malware, four permission defects. Separate the genuine escalation paths from the capabilities that are meant to be there, then pick the single change that removes the most privilege.