Default passwords. Bad secret management (hardcoded in Git, shared secrets not changed after an employee left ...) Dev and live not properly separated/dev not

Default passwords. Bad secret management (hardcoded in Git, shared secrets not changed after an employee left ...) Dev and live not properly separated/dev not properly secured. Services exposed to the internet that shouldn't be. Old and forgotten software / appliances. Don't forget about the dev/sysadmin workstations!