There is no straight answer to this question as vulnerabilities can be present anywhere in the organization: main websites, core systems, remote access systems, mobile apps, and management systems. It’s true that many “low hanging fruit” vulnerabilities exist in overlooked corners of an organization, for example an old testing environment of a side channel system is prone to have old and outdated frameworks. The attacker does not care that the system is not in use, or forgotten, as long as he can exploit it and make it an entry point to the organization’s internal network. An organization should always be aware of its weak spots by regularly performing penetration tests on every system and on its entire network.