Give up! Just stop patching vulnerabilities!
summary
40,000 new CVEs in a month and a trend toward >100,000 per year make patching hopeless, with ~60% of breaches tied to known but unfixed flaws. Root-cause work using CWE, CAPEC and MITRE ATT&CK targets whole classes like XSS and SQLi (Twitter XSS example) and yields results (ClearBank cuts 91% of noise, teams at Netflix remove classes in CI/CD). Practical moves: threat modeling, ephemeral infrastructure and burn-and-replace methodologies to design systems secure-by-default and need far fewer patches.
AI-written summary · about
chapters (9)
- 0:00Introduction and challenge
- 1:54Vulnerability volume crisis
- 5:10Threat-centric security approach
- 7:20Key frameworks CWE CAPEC TTPs
- 13:01Success stories and prevention
- 15:10Threat modeling strategies
- 17:26Ephemeral infrastructure
- 19:32Key takeaways and next steps
- 20:59Resources and conclusion
related talks
59mTeam of 30 million: Reducing Software Vulnerability at a Global Scale
39mSoftware Security Engineering (Learnings from the past to fix ...)
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
33mWhy have we not fixed all the vulnerabilities yet? Different perspectives...
29mGet the Freaking Basics Right!
15mKeynote
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
40mEmbracing Security - A Changing DevOps Landscape