I’d love to see an honest blog post from MS after all this effort on what worked and didn’t.
A massive horizontal effort like this is especially challenging after accruing substantial security debt over years
A massive horizontal effort like this is especially challenging after accruing substantial security debt over years
I was listening to Security Now a couple of weeks ago (I didn't read/research on this further) and they said that some LLM ran through the CVEs and from the description only managed to successfully create code to take advantage in 70%-80% of them.
It is amusing how MS is losing the "NOBUS" game, got bitch-slapped by the EDPS a couple of months ago, and need to say/do something to save face.
In Project Management the deal is "say-do-say". To what @wepple wrote above, it would be interesting to see on a semi-annual basis what the latter 'say' is (what did they actually did/and it worked). Understanding the sensitivity of security impact "hey we found XYZ vuln on ABC system" would be irresponsible for people still using said-ABC outdated system.
(semi-rant, but my honest thoughts)(I wish MS the very best, I got some stocks of MS so I want them to succeed) :)