By Jackson Godwin. Cybersecurity Analyst & Penetration Tester.

---

The Biggest Cybersecurity Mistake I Made Early in My Career—And the Lesson I’ll Never Forget

Disclaimer: This story is inspired by common lessons learned in cybersecurity careers. It has been written for educational purposes to help aspiring cybersecurity professionals understand the importance of preparation, communication, and responsible security practices.

---

I Wanted to Prove Myself

Everyone remembers their first big opportunity.

Mine came early in my cybersecurity career.

At that time, I was still learning.

Every new project felt exciting.

Every meeting felt important.

I wanted to show everyone that I deserved to be there.

When my manager assigned me to assist with a vulnerability assessment project, I could barely hide my excitement.

This was exactly the type of work I had been studying for months.

Finally…

I had the chance to apply my knowledge in a real business environment.

---

I Prepared for Days

I didn’t want to disappoint anyone.

So I prepared carefully.

I reviewed my notes.

Updated my security tools.

Checked my laptop twice.

Tested my VPN connection.

Read through previous assessment reports.

I even arrived at the office earlier than usual.

In my mind, everything was ready.

Or at least…

That’s what I believed.

---

Confidence Can Be Dangerous

Looking back now, I realize something.

There is a difference between confidence and overconfidence.

Confidence helps you perform.

Overconfidence makes you stop asking questions.

Unfortunately…

I was beginning to cross that line.

I believed that because I understood the technical tools, I was fully prepared.

What I didn’t understand yet was that cybersecurity isn’t only about technology.

It’s also about communication.

Planning.

Verification.

Documentation.

And paying attention to small details.

---

The Client Was Waiting

The client was a growing company that wanted to identify weaknesses in its systems before attackers could.

The project looked straightforward.

Our team had already discussed the assessment scope.

Everyone knew their responsibilities.

Before we started, my senior colleague reminded the team of something important.

“Never assume anything.”

At the time, I smiled.

I thought he was simply being cautious.

I didn’t realize those four words would become one of the biggest lessons of my career.

---

I Thought I Understood the Scope

The assessment included several approved systems.

We had written authorization.

Everything appeared organized.

I reviewed the project documentation.

Or at least…

I thought I had.

I believed I understood exactly which systems we were supposed to assess.

Instead of asking one final question, I trusted my memory.

That was my mistake.

---

One Small Assumption

The work began smoothly.

I started reviewing the assigned systems.

Everything looked normal.

Then I noticed another server listed in one of the network diagrams.

I assumed it belonged to the assessment.

Without stopping to verify, I included it in my notes.

It seemed like a small decision.

After all…

It was connected to the same environment.

Why wouldn’t it be part of the project?

That assumption would soon create an uncomfortable conversation.

---

My Senior Asked One Simple Question

About thirty minutes later, my senior colleague walked over to my desk.

He looked at my screen.

Then he asked,

“Why are you reviewing that server?”

I answered confidently.

“It’s part of today’s assessment.”

He looked at me for a few seconds.

Then quietly replied,

“No… it isn’t.”

At that moment, my confidence disappeared.

I opened the project documentation again.

This time, I read it much more carefully.

He was right.

That server wasn’t included in the approved assessment scope.

I had assumed instead of verifying.

---

It Could Have Been Much Worse

Fortunately, I hadn’t performed any intrusive testing.

I had only begun reviewing information.

The mistake was caught early.

No damage occurred.

No systems were affected.

But the lesson stayed with me.

Because I realized something important.

In cybersecurity, even small assumptions can lead to much bigger problems if they aren’t corrected quickly.

---

I Felt Embarrassed

For the rest of the day, I couldn’t stop thinking about what had happened.

I kept asking myself,

“Why didn’t I simply ask before proceeding?”

The answer was uncomfortable.

I didn’t want to appear inexperienced.

Ironically, trying to avoid asking a simple question almost created a much bigger problem.

That day taught me something I still remember years later.

There is nothing unprofessional about asking for clarification.

Sometimes, asking one question is the most professional thing you can do.

---

The Lesson Had Only Begun

I thought my biggest mistake had already happened.

I was wrong.

Later that afternoon, my senior colleague shared a lesson that completely changed the way I approached every cybersecurity project after that.

It wasn’t about hacking.

It wasn’t about penetration testing.

It wasn’t even about technology.

It was about responsibility.

And it became one of the most valuable lessons of my entire career.

(Continue in Part 2, where my senior cybersecurity consultant explains why assumptions are dangerous, how proper communication protects both clients and security professionals, and why technical skills alone are never enough.)