By Jackson Godwin. Cybersecurity Analyst & Penetration Tester.
The Conversation That Changed My Career
After my senior colleague pointed out my mistake, I expected him to be angry.
Instead…
He pulled up a chair beside me.
He looked at the project documentation.
Then he smiled.
“Don’t worry,” he said.
“Every cybersecurity professional makes mistakes. The important thing is learning from them before they become serious incidents.”
That simple sentence stayed with me.
He wasn’t interested in embarrassing me.
He wanted to teach me something that no certification course had ever explained.
Cybersecurity Is Built on Trust
He asked me a question.
“Why do organizations allow us to test their systems?”
I immediately answered,
“Because they want us to find vulnerabilities.”
He nodded.
Then he replied,
“That’s only part of the answer.”
The real reason, he explained, was trust.
Organizations trust cybersecurity professionals with access to sensitive systems, confidential information, and critical infrastructure.
That trust comes with responsibility.
If we step outside the agreed scope—even by accident—we risk damaging that trust.
Scope Is More Than Paperwork
Before that day, I saw the project scope as just another document.
Something to read quickly before beginning work.
My senior explained why that thinking was dangerous.
The project scope defines:
- Which systems may be tested.
- Which systems must not be touched.
- When testing is allowed.
- Which techniques are approved.
- Who has authorized the assessment.
Without a clearly defined scope, even legitimate security testing can create unnecessary problems.
That was the moment I understood that cybersecurity is not just about finding vulnerabilities.
It’s about working responsibly.
Never Assume—Always Verify
My senior repeated the same advice he had given that morning.
“Never assume.”
Then he added,
“If you’re unsure, ask.”
Those seven words became one of the most valuable lessons of my career.
In cybersecurity, assumptions can lead to:
- Testing the wrong system.
- Missing important assets.
- Confusing clients.
- Delaying projects.
- Creating unnecessary risk.
Verification takes only a few minutes.
Fixing a mistake can take much longer.
Documentation Protects Everyone
He also showed me something I had overlooked.
Every action performed during a security assessment should be documented.
Good documentation helps answer questions like:
- What was tested?
- When was it tested?
- Who performed the work?
- Which tools were used?
- What findings were identified?
Documentation protects both the client and the security team.
Without clear records, misunderstandings become much more likely.
Technical Skills Alone Are Not Enough
At that stage in my career, I believed success depended mainly on technical ability.
I spent hours learning:
- Nmap.
- Burp Suite.
- Metasploit.
- OWASP Top 10.
- Vulnerability scanning.
Those skills are important.
But my senior explained something I hadn’t fully appreciated.
Great cybersecurity professionals also develop:
- Communication skills.
- Attention to detail.
- Professional ethics.
- Patience.
- Critical thinking.
Technology changes constantly.
Good judgment remains valuable throughout your career.
I Started Asking More Questions
That experience changed my behaviour almost immediately.
Instead of pretending I understood everything, I started asking questions whenever I wasn’t completely certain.
Questions like:
- Is this system included in scope?
- Has the client approved this activity?
- Should we verify this configuration first?
- Can we confirm these IP addresses?
At first, I worried people might think I lacked experience.
The opposite happened.
My colleagues appreciated that I wanted to be accurate rather than making assumptions.
The Lesson Went Beyond Cybersecurity
As time passed, I realised the lesson applied to almost every area of life.
Assumptions create unnecessary mistakes.
Verification creates confidence.
Whether you’re conducting a penetration test, configuring a firewall, reviewing an audit report, or responding to a security incident, taking a few extra minutes to verify information can prevent much bigger problems later.
That simple habit has saved me more times than I can count.
The Mistake Became a Turning Point
Looking back today, I’m actually grateful that the mistake happened early in my career.
It happened in an environment where an experienced mentor noticed it before it became a serious issue.
More importantly, it taught me a lesson that no textbook could have explained.
From that day forward, I stopped trying to prove that I knew everything.
Instead, I focused on learning continuously, communicating clearly, and verifying before acting.
In the final part of this article, I’ll share the practical habits I developed after that experience, the advice I give to every aspiring cybersecurity professional, the biggest lesson I carried into every VAPT engagement, and why humility may be one of the most valuable cybersecurity skills you can ever develop.
Continue Reading: The Biggest Cybersecurity Mistake I Made Early in My Career—And the Lesson I’ll Never Forget (Part 3)
