They may not necessarily have compromised the entire system.<p>Consider for example, SQL injection. Alternatively, some kind of DB dump mistakenly exposed in the webroot. Neither should happen but they&#x27;re real-world examples. Sometimes misconfiguration leaves you in a weird state.