Outsmarting attackers starts with awareness
When mistakes become entry points
In 2023 alone, more than 28,000 new software vulnerabilities were reported. That’s 78 per day. In the time it takes to finish this paragraph, another one might already have been discovered. And the worst part? Many of them are small, easy to miss, and introduced with the best of intentions.
So, how do these tiny flaws become the very reason an attacker gains control of a production-critical system in discrete manufacturing? That’s the question we set out to answer—in our recent live session and now in this follow-up.
The vulnerability landscape is changing
Software runs everything—from supply chains to robotics to product lifecycle systems. But while innovation has sped up, so have attackers.
Threat actors no longer need deep technical skills to exploit software. With the help of generative AI, even entry-level adversaries can reverse-engineer logic, simulate API calls and generate working exploit code. In the last year alone, CrowdStrike tracked more than 250 active adversary groups, many of which now leverage AI to move faster and attack smarter.
Meanwhile, the number of known vulnerabilities keeps climbing: over 74,000 new CVEs in the past three years. Many of these are found in third-party components and dependencies—parts of your application you didn’t write but still carry the risk for.
The rise of access brokers and exploit-chaining makes things even more difficult. Attackers specialize in initial access, then sell that access to others who escalate and monetize it. In other words: your weakest exposed interface might be worth real money—to someone else.
Our perspective: Security begins where code is written
Too often, software teams see security as a gate. Something to pass at the end. But that thinking is outdated—and dangerous.
Security must start at the very beginning: during design, implementation and review. Not because compliance demands it, but because attackers don’t wait until release day.
We believe in shifting the perspective. Think like an attacker, and you’ll code like a defender. In our work with clients, we’ve seen how small changes—like integrating secure coding patterns, using SCA/SAST tools with real prioritization logic, and training developers in common exploit paths—can reduce exposure dramatically.We also urge teams to treat AI with caution. While generative tools can accelerate development, they also replicate outdated or vulnerable patterns if not reviewed critically. "Paste now, patch later" is not a strategy.
How do you hide a needle in a haystack? Easy: just bury it in code.
What's coming—and what matters most
The attack surface will keep growing. So will automation, connectivity and pressure to ship faster.
Security has to scale with it. This doesn’t mean hiring more defenders. It means enabling developers, architects and product owners to make smarter security decisions early—without slowing innovation.
Expect attacker techniques to become more contextual, more targeted and more AI-supported. But also expect defenses to become smarter—if we build them into the DNA of software development.
The companies that will thrive are those that integrate security into product thinking—not as a feature, but as a foundation.
So, what now?
Software will never be perfect. Vulnerabilities will happen.
The real question isn’t if an attacker will find them. It’s when—and whether we’re ready.
What if the best way to prevent the next breach… is to think like the one who might cause it?
Let’s talk about it.
Markus Blankenburg
Senior Secure Application Engineer / Senior Manager Application Security
View detailsof Markus Blankenburg>Categories
Related posts
- Customer-centric excellence: understanding and delivering a top-notch service
- AI-Driven threat detection in cybersecurity: opportunities and challenges for organizations
- The Agentic AI revolution: Transforming IT support from reactive to proactive
- Agentic AI: The next wave of intelligent process automation