Outsmarting attackers starts with awareness

When mistakes become entry points

In 2023 alone, more than 28,000 new software vulnerabilities were reported. That’s 78 per day. In the time it takes to finish this paragraph, another one might already have been discovered. And the worst part? Many of them are small, easy to miss, and introduced with the best of intentions.

So, how do these tiny flaws become the very reason an attacker gains control of a production-critical system in discrete manufacturing? That’s the question we set out to answer—in our recent live session and now in this follow-up.

The vulnerability landscape is changing

Software runs everything—from supply chains to robotics to product lifecycle systems. But while innovation has sped up, so have attackers.

Threat actors no longer need deep technical skills to exploit software. With the help of generative AI, even entry-level adversaries can reverse-engineer logic, simulate API calls and generate working exploit code. In the last year alone, CrowdStrike tracked more than 250 active adversary groups, many of which now leverage AI to move faster and attack smarter.

Meanwhile, the number of known vulnerabilities keeps climbing: over 74,000 new CVEs in the past three years. Many of these are found in third-party components and dependencies—parts of your application you didn’t write but still carry the risk for.

The rise of access brokers and exploit-chaining makes things even more difficult. Attackers specialize in initial access, then sell that access to others who escalate and monetize it. In other words: your weakest exposed interface might be worth real money—to someone else.

Our perspective: Security begins where code is written

Too often, software teams see security as a gate. Something to pass at the end. But that thinking is outdated—and dangerous.

Security must start at the very beginning: during design, implementation and review. Not because compliance demands it, but because attackers don’t wait until release day.

We believe in shifting the perspective. Think like an attacker, and you’ll code like a defender. In our work with clients, we’ve seen how small changes—like integrating secure coding patterns, using SCA/SAST tools with real prioritization logic, and training developers in common exploit paths—can reduce exposure dramatically.We also urge teams to treat AI with caution. While generative tools can accelerate development, they also replicate outdated or vulnerable patterns if not reviewed critically.  "Paste now, patch later" is not a strategy.