Why have we not fixed all the vulnerabilities yet? Different perspectives...
summary
CVE counts show a steady rise since 2016 and 2023 year‑to‑date already lists about 7–7.5k entries, and teams report a 640× cost increase when fixes wait until post‑release. Reality is concrete: nightly dependency update jobs and automated scanners catch many issues early, one developer often fixes a backlog ticket, while upgrades that require cross‑country migrations can cost seven‑figure effort and get deferred. Practical fixes are shift‑left threat modeling and automation; late audits trigger risky workarounds.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:01Why vulnerabilities remain
- 7:01Vulnerability lifecycle
- 11:36Who is responsible for fixing vulnerabilities
- 16:52Management’s role
- 19:02Cost of fixing
- 21:09Prioritizing security vs features
- 23:20Developers’ responsibility
- 25:33When vulnerabilities are fixed
- 26:15Strategies to improve vulnerability fixing across teams
- 31:57Summary
related talks
22mGive up! Just stop patching vulnerabilities!
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
09mInterview
14mThe State of Open Source Vulnerabilities Management in 2019
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
56mOutpacing Attackers: How Data-Driven Insights Speed Up Vulnerability Remediation
17mThe Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?