The pursuit of “zero CVEs” (common vulnerabilities and exposures) in software is not only unattainable: It diverts critical resources from real-world security challenges. Leaders who have adopted the zero-CVEs tagline are finding themselves with a proverbial hangover from their complicated and fragile mitigation strategy. This obscures a true understanding of your security posture, and leaves you with a foggy, if not incomplete, picture of how vulnerable you really are.
The best way to avoid this hangover is by adopting a transparent…
