"Attackers only have to get it right once"... Let's re-examine this widely held belief, shall we :) ? https://sparcflow.substack.com/p/the-attacker-only-has-to-get-it-right

"These are important vulns, but, our roadmap is full for at least six months". Classic rebuttal to a vulnerability. The discussion then shifts into a Tetris-like game trying to fit imaginary deadlines. I detail how to avoid this trap in my book https://www.amazon.com/dp/B0C4LC4FDW