| ▲ | khalic 6 hours ago | |||||||||||||||||||||||||
The standard here is not enough when the agent can escalate by finding 0 days, for example. It’s like giving a black hat a limited account. Sure it might restrict him, but not giving him an account at all is way better | ||||||||||||||||||||||||||
| ▲ | gowld 6 hours ago | parent [-] | |||||||||||||||||||||||||
The black hat can find 0-day escalation in your sandbox, too. A user account is a sandbox. | ||||||||||||||||||||||||||
| ||||||||||||||||||||||||||