This problem, though, is multiple-fold. The author gave a non technical perspective, but I'd like to add some points that he missed in the article.
1. Companies have no legal incentives to share they've been breached. Quite the opposite, it's better from both a financial and a legal standpoint to keep it a secret. This has to change, and legislative bodies failed to do so.
2. Vendors don't have legal incentives either. If Siemens is breached, nobody knows about it. And that is very dangerous, considering their role in critical infrastructure. CERT tries to change this, but guess what, Siemens doesn't disclose shit there.
3. Software vendors don't even maintain their software and they get away with it. Look at Sophos, Fortinet and others. Multiple RCEs over the years due to them writing HTTP parsers in C++ without any quality improvements. Code is written so sloppy that even SQLi works, and apparently never improved upon and neither refactored.
4. All measurements are hypothetical. Especially risk management is completely made up. They always cheat themselves by claiming "this is not feasible", well, even though the RCEs are shared as PoCs on Telegram. Being blind to better sources of information actually helps them cheat their own metrics, and lazy teams are, well, lazy. This somehow crosses over with cyber intelligence now, but in general all ratings of CVEs are bogus and the only ones you can trust are Arch Linux and Alpine. Debian always closes their hardforked version freezed but affected packages as "won't fix/not affected", and then it turns out they get hacked, too. Happened a lot of times. Lots of distros have OVAL data available, which makes this at least discoverable if you write your own software (or use ours :) )
5. EDR software and inventory software are as disconnected from each other as possible, which is a huge mistake. If you ask a blueteam about how many devices are in their network, you will be baffled by their answers.
Source: Am building an EDR software for POSIX systems from scratch, that is able to analyze malware on both a network level and an in-memory disassembler level (written in go and ebpf) and tries to change the game mechanics with automated communication between EDR agents.