- catching up on 0days: as organizations grow in headcount, their internal review and release processes naturally becomes slower; inversely relative to the amount of programming languages, frameworks, tools they involve in their toolkit which grows overtime. put out everything publicly now everything is a possible attack surface.
- incentives on finding vulnerabilities: should you get $1k to 100k on bug bounty, or should you steal $1m to $10m when you can?
- complexity on international scale: consider large fraudulent transactions through banks A, B, C where each bank is headquartered in different countries. will those banks comply / cooperate? up to how much is insured? how long until users get their money back? up to what point will law enforcement agencies can be involved?