“Our products are not targets”

Reality: If your products connect to anything valuable, they are a target.

Attackers aren't always aiming at your product specifically. They look for access, leverage, and opportunity. Most successful attacks don't start with a named target but with a weakness in code or a misconfigured setting. As AI drives down the cost of reaching each target, being small stops working as protection (see AI-07).

The right question isn't "Why would anyone try to compromise our customers via our product?" It's "How do I protect them from attackers who will exploit any weakness?"

Discussion prompts

• Does your organization have a documented threat model for each product it sells/publishes?
• How does your threat model account for how attackers will target your product in customer environments — not just in ideal conditions?
• How would you know if your product was already being probed or exploited at customer sites? What mechanisms are missing?