--- title: Finished Is When the Old Way In Is Gone description: A security project is finished when the old way in stops answering and someone who did not build the new one has looked for what was missed. image: https://pathinsights.io/hubfs/s2_hero-1600x900.png --- [![logo](https://pathinsights.io/hs-fs/hubfs/Artboard%204@4x.png?width=200&height=86&name=Artboard%204@4x.png "logo")](https://pathinsights.io) Search toggle - [Home](https://pathinsights.io) - [Resources](https://pathinsights.io/insights) - [Contact Us](https://pathinsights.io/insights/finished-is-when-the-old-way-in-is-gone#contact) [Follow us on Facebook](https://www.linkedin.com/company/pathinsights) [![logo](https://pathinsights.io/hs-fs/hubfs/Artboard%204@4x.png?width=200&height=86&name=Artboard%204@4x.png "logo")](https://pathinsights.io) - [Home](https://pathinsights.io) - [Resources](https://pathinsights.io/insights) - [Contact Us](https://pathinsights.io/insights/finished-is-when-the-old-way-in-is-gone#contact) Search toggle [![](https://pathinsights.io/hs-fs/hubfs/Artboard%201@4x.png?width=299&height=86&name=Artboard%201@4x.png)](https://pathinsights.io) - [Home](https://pathinsights.io) - [Resources](https://pathinsights.io/insights) - [Contact Us](https://pathinsights.io/insights/finished-is-when-the-old-way-in-is-gone#contact) [Follow us on Facebook](https://www.linkedin.com/company/pathinsights) Search toggle What are you looking for? Search # Finished Is When the Old Way In Is Gone 23 Oct 2026 ![Picture of Francisco J Peña](https://pathinsights.io/hs-fs/hubfs/Imported%20images/1727142866446%3Fe=1733961600%26v=beta%26t=PZB-1WDzWivHhRvCIEYOC61KkAr30O73eaFc9UPsTzc.jpeg?width=40&name=1727142866446%3Fe=1733961600%26v=beta%26t=PZB-1WDzWivHhRvCIEYOC61KkAr30O73eaFc9UPsTzc.jpeg) [Francisco J Peña](https://pathinsights.io/insights/author/francisco-j-peña) ![Finished is when the old way in is gone. A new gateway standing next to an old public address is two ways in, and the security of the weaker one.](https://pathinsights.io/hubfs/s2_hero-1600x900.png) Picture a business with one system that people need to reach from outside the building. For years the way in was a public address and a password. Then the business does the responsible thing: it pays to have a proper gateway built in front of that system, the work gets done, and a letter arrives saying the project is complete. That is the picture. Here is the part I have watched, and it is the reason I no longer accept "complete" from anyone, including myself, until one specific thing has happened. The old way in is still there. ## The line item nobody owns The new path gets built with care, because it is what was bought. Retiring the old one sits at the end of a checklist as somebody's later task, and it waits on a person confirming that nobody still needs the old address. That means asking people who are busy. So it slips, the new gateway goes live, and the old public address keeps answering. I have watched that gap stay open for a long stretch, through nobody's negligence. It sat where it was put, on a list of things to do later, and later kept arriving with something more urgent attached. The uncomfortable arithmetic is that for all that time the company is paying for two ways in and getting the security of the weaker one. Every control on the new path is real. It is also beside the point for anything that can still reach the old address. ## What the gateway logs are telling you There is a tell, and most owners have never looked at it. Anything with a public address gets probed constantly by automated scanning that runs against the whole internet without caring who you are. A gateway that is doing its job will show you a steady stream of connection attempts from places you have never done business with, all blocked. The natural reading is reassurance: look how much the new thing is stopping. The better reading is the opposite. That stream tells you what anything still exposed in your environment is receiving as well. If the gateway is seeing it, so is whatever else you left reachable. The gateway's block log is the strongest argument you will ever get for finishing the retirement, and it is sitting there for free. ## The test that ran once The second pattern is about testing, and it is more common than the first. Good designs get tested by trying to do the thing that is supposed to be impossible. If people coming through the new gateway are meant to reach one system and nothing else, the test is to sit on that connection and try to reach something else. It should fail, and the failure should be logged. Here is what I have seen. That test gets run once, in the pilot, against test machines, and it passes, and the design is signed off on the strength of it. Then the real thing goes live later, with its own configuration, and nobody can show me that the test was ever run again against what people are actually using. So put the negative test on the go-live checklist rather than the design checklist, and run it against the real system on the day. It takes minutes. If it fails because a rule was copied wrong, you find out in a room with the engineer, on the day, instead of a year later from somebody who noticed by accident. ## A locked-out user on the first morning is good news One more pattern from the same family, because it looks like a defect and is the opposite. Setups built on the principle that nobody gets access they were not explicitly granted have a predictable failure mode: somebody who should have been added to a group was not, and on the first morning they cannot get in. It looks like the project broke. What happened is that the system did not fill the gap on its own, which is exactly what you paid for. The answer is to rehearse the roles rather than loosen the rule. The day before go-live, have a real person from each group sign in and do one real task. Whatever is missing shows up then, with time to add it, instead of at eight in the morning with a room full of people who cannot work. ## The check that has to come from outside Everything above is about the builder finishing the job. The last piece is about who confirms it, and here I hold a view that some vendors will not love. The team that built your new path is the wrong team to certify that no old path remains, and honesty has nothing to do with it. They know where they put things, and an inventory of every way into an environment is a search for what somebody did not put there: an address that never got removed, a remote tool a departed contractor installed, a maintenance login on a printer. Familiarity is the enemy of that search. A fresh set of eyes, given the simple question "list every way into this environment from the outside," will find things the builders walk past because those things were never on the builders' drawing. That check can be cheap and plain. What it has to be is independent, written down, and done before you treat the project as finished rather than after something reminds you. ## What finished actually looks like Read a closeout letter with these four questions next to it, and you will know within a minute whether the project is done or whether the deliverable is done: Has every old way in been retired, on a named date, with confirmation that it no longer answers? If the letter leaves that for you to handle later, put a date on it before you sign. Until that date passes, the project has one more step and it is yours now. Was the negative test run against the real system on the day it went live, and not only in a pilot? Did a real person from every access group sign in and do real work in rehearsal the day before? Has someone who did not build the new path produced a written inventory of every way in, and has that list been reconciled against what you expected to be there? Four yes answers and you can sign. Anything else and you have a good new gateway standing next to the reason you needed one. --- *I write about the unglamorous half of operations work, from inside real operations. More at pathinsights.io.* ### Share: [Share on Facebook](http://www.facebook.com/share.php?u=https://pathinsights.io/insights/finished-is-when-the-old-way-in-is-gone&utm_medium=social&utm_source=facebook) [Share on LinkedIn](http://www.linkedin.com/shareArticle?mini=true&url=https://pathinsights.io/insights/finished-is-when-the-old-way-in-is-gone&utm_medium=social&utm_source=linkedin) [Share on X](https://twitter.com/intent/tweet?original_referer=https://pathinsights.io/insights/finished-is-when-the-old-way-in-is-gone&utm_medium=social&utm_source=twitter&url=https://pathinsights.io/insights/finished-is-when-the-old-way-in-is-gone&utm_medium=social&utm_source=twitter&source=tweetbutton&text=Finished%20Is%20When%20the%20Old%20Way%20In%20Is%20Gone) ## Francisco J Peña With over a decade of experience in operations and analytics, I specialize in transforming business processes through data-driven insights, automation, and digital solutions. At Path Insights LLC, I focus on helping businesses streamline their operations, modernize executive reporting, and make faster, informed decisions by leveraging advanced data analytics. ## Related posts Search [The Search Came Back Empty](https://pathinsights.io/insights/the-search-came-back-empty) ![Artboard 4@4x](https://pathinsights.io/hs-fs/hubfs/Artboard%204@4x.png?width=500&name=Artboard%204@4x.png "Artboard 4@4x") One team to fix your processes, connect your systems, and deliver insight you trust. [www.pathinsights.io](http://www.pathinsights.io) | [Privacy Policy](https://pathinsights.io/privacy-policy) [Follow us on Facebook](https://www.facebook.com/61569388859737) [Follow us on Facebook](https://www.linkedin.com/company/pathinsights/) Cookie settings [Privacy policy](https://pathinsights.io/privacy-policy)[Privacy contact](mailto:franciscojpena@pathinsights.io) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Francisco J Peña", "url" : "https://pathinsights.io/insights/author/francisco-j-peña" }, "dateModified" : "2026-10-23T17:22:45.759Z", "datePublished" : "2026-10-23T17:22:29.000Z", "headline" : "Finished Is When the Old Way In Is Gone", "image" : [ "https://pathinsights.io/hubfs/s2_hero-1600x900.png" ], "mainEntityOfPage" : { "@id" : "https://pathinsights.io/insights/finished-is-when-the-old-way-in-is-gone", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://pathinsights.io/hubfs/Artboard%201@4x.png" } } } ```