The Harm Is Measurable

HARM · THE EVIDENCE

The harm is real, even when it is hard to trace.

Hospitals: peer-reviewed research links ransomware attacks to increased patient mortality.

Data: a single defect in one file transfer product exposed about 95 million people across 2,700 organizations.

Commerce: a defect in an IT management tool closed most of the 800 stores of a Swedish grocery chain, a company that had never bought the product.

Manufacturers ship the defect. Everyone else absorbs it.

HARM · THE PATTERN

The Defects Are Not New

Exploiting product defects is now the leading way into a breach, ahead of stolen credentials.

The defect classes are decades old. In 2026 alone, CISA added SQL injection flaws in content management, analytics, and security products to its Known Exploited Vulnerabilities (KEV) catalog. SQL injection was documented in 1998.

Software developers did not suddenly get worse. Manufacturers face no consequence for shipping defect classes the field solved long ago.

The harm is measurable. So is the choice not to prevent it.