Comment by 3abiton
4 hours ago
> because old software is going to be patched or thrown away and new one is going to be security-scanned and tested.
I highly disagree with this, I've worked in many environment and I can tell you some medium/big companies do not adapt fast enough, some have multiple projects, and when someone critical leaves, many of these projects remain unmaintained but "working". If you don't have deep monitoring, you won't even detect that you've been "hacked" or "infiltrated". Companies accepted that risk because the pace from CVE -> exploitation was big enough, but now with AI, exploitation at scale is easier than ever.
> Companies accepted that risk because the pace from CVE -> exploitation was big enough, but now with AI, exploitation at scale is easier than ever.
So that's what I'm saying, the business incentives are changed, there is no more room for the ignorance of the security. You either maintain it or you are out of business. Brutal period, but now everybody is forced to update, fix and improve the isolation because every script-kiddy can deploy a 0day every week. That helps to fix things against actually dangerous actors who had resources for 0days before the AI boom and used this negligence to harm people worldwide.