“Attackers keep adapting”

Reality: The difference is real. A fire captain fights physics: unpredictable, indifferent, not trying to win. An army captain fights someone who can wait, feint, spend more, and come back tomorrow.

You fight an intelligent adversary by changing the landscape and raising the cost of their campaign. That argues for secure by design, not against it. Eliminating the Lucky 13 (see UV-01) does both; patching instances does neither.

Thirty years in, adaptability explains the pressure. It does not excuse the outcome.

Discussion prompts

• Your adversary can retry indefinitely. Which of your defect classes would that eventually find?
• What in your product raises the cost of a campaign, rather than the cost of a single attempt?
• Which Lucky 13 defect classes (see UV-01) still show up in your product's incident history?