security scanner flagged our staging database as critical vulnerability. its literally not accessible from internet

So what you're saying is, "What if someone takes advantage of the largest attack surfaces that a company has." Firstly, my point was simple, you should consider the attack surface when prioritizing remediation. So obviously the large attack surface on prevelance of phishing should way into how you prioritize addressing threats. So what your saying isn't contrary to what I said at all. Secondly, I would say users ARE the perimeter. As you said yourself, "and a threat actor gets a foothold in your environment." Users are an initial attack vector and in fact the most common one so we should think of them as a perimeter. I'd go further and say that right now orgs should be aiming for users being the only perimeter and completely closing off internet facing systems where possible. We've never had as many tools to do this as we do now. Thirdly, and this is a bit irrelevant but it's worth talking about. I know it's possible for phishing to lead to gaining a foothold in a network and moving from there but overwhelmingly phishing is used financial fraud, it's far easier, it's much more profitable and it isn't completely thwarted by fairly basic EDR. I mean that's why you see the cases where phishing leads to actual network access usually involving the attackers leveraging stolen credentials to log into an internet facing service like a VPN endpoint. Just phishing a password alone isn't much use if you can't plug it into something. So talking about phishing as if it's a common path to network access is a bit off to me. Like you generally aren't going to get phished and then have the attackers move lateraly leveraging vulnerabilities. Phishing attacks almost always result in data breaches of whatever (usually third party) system credentials were stolen for. Like you don't get your email or CRM account phished and then suddenly end up with hackers hitting your internal servers. Fourth, considering the OP is talking about an inventory management system that has an API that's apparently vulnerable because of basic authentication, if the attacker is already in your network I don't see why they'd start targetting an inventory management system's API. Okay if your hypervisor has a vulnerability that's a real problem because anyone with a foothold could then elevate their access to something more important. But the basic auth on the API of an inventory management system? Why? That's the sort of vulnerability you'd hit if you were looking to gain a foothold, not if you were already in their network. You probably wouldn't even be able to access the API endpoint from the internal network anyway. Anyway, this ended up being much longer than expected but now that I've thought about it more, I actually back the OP even more. They seem to have some very strong security controls to mitigate the risks associated with basic auth on the API since they're blocking access to the endpoint unless it's specifically from the system that needs the access. I think it's fine to knock that vulnerability down the list of priorities compared to open S3 buckets the OP mentioned.