To gain root access at this company, all an intruder had to do was ask nicely

The article describes social-engineering failures where a penetration tester impersonated an executive and obtained a password reset (including having IT set a caller-supplied password), highlighting poor verification procedures and the human factor in security; it also notes a challenge–response mitigation implemented by one practitioner.