Privacy policy

Our website uses cookies to enhance your online experience by; measuring audience engagement, analyzing how our webpage is used, improving website functionality, and delivering relevant, personalized marketing content.
Your privacy is important to us. Thus, you have full control over your cookie preferences and can manage which ones to enable. You can find more information about cookies in our Cookie Policy, about the types of cookies we use on Atos Cookie Table, and information on how to withdraw your consent in our Privacy Policy.

Our website uses cookies to enhance your online experience by; measuring audience engagement, analyzing how our webpage is used, improving website functionality, and delivering relevant, personalized marketing content. Your privacy is important to us. Thus, you have full control over your cookie preferences and can manage which ones to enable. You can find more information about cookies in our Cookie Policy, about the types of cookies we use on Atos Cookie Table, and information on how to withdraw your consent in our Privacy Policy.

Skip to main content

Outsmarting attackers starts with awareness

When mistakes become entry points

In 2023 alone, more than 28,000 new software vulnerabilities were reported. That’s 78 per day. In the time it takes to finish this paragraph, another one might already have been discovered. And the worst part? Many of them are small, easy to miss, and introduced with the best of intentions.

So, how do these tiny flaws become the very reason an attacker gains control of a production-critical system in discrete manufacturing? That’s the question we set out to answer—in our recent live session and now in this follow-up.

The vulnerability landscape is changing

Software runs everything—from supply chains to robotics to product lifecycle systems. But while innovation has sped up, so have attackers.

Threat actors no longer need deep technical skills to exploit software. With the help of generative AI, even entry-level adversaries can reverse-engineer logic, simulate API calls and generate working exploit code. In the last year alone, CrowdStrike tracked more than 250 active adversary groups, many of which now leverage AI to move faster and attack smarter.

Meanwhile, the number of known vulnerabilities keeps climbing: over 74,000 new CVEs in the past three years. Many of these are found in third-party components and dependencies—parts of your application you didn’t write but still carry the risk for.

The rise of access brokers and exploit-chaining makes things even more difficult. Attackers specialize in initial access, then sell that access to others who escalate and monetize it. In other words: your weakest exposed interface might be worth real money—to someone else.

Our perspective: Security begins where code is written

Too often, software teams see security as a gate. Something to pass at the end. But that thinking is outdated—and dangerous.

Security must start at the very beginning: during design, implementation and review. Not because compliance demands it, but because attackers don’t wait until release day.

We believe in shifting the perspective. Think like an attacker, and you’ll code like a defender. In our work with clients, we’ve seen how small changes—like integrating secure coding patterns, using SCA/SAST tools with real prioritization logic, and training developers in common exploit paths—can reduce exposure dramatically.We also urge teams to treat AI with caution. While generative tools can accelerate development, they also replicate outdated or vulnerable patterns if not reviewed critically.  "Paste now, patch later" is not a strategy.

How do you hide a needle in a haystack? Easy: just bury it in code.

What's coming—and what matters most

The attack surface will keep growing. So will automation, connectivity and pressure to ship faster.

Security has to scale with it. This doesn’t mean hiring more defenders. It means enabling developers, architects and product owners to make smarter security decisions early—without slowing innovation.

Expect attacker techniques to become more contextual, more targeted and more AI-supported. But also expect defenses to become smarter—if we build them into the DNA of software development.

The companies that will thrive are those that integrate security into product thinking—not as a feature, but as a foundation.

So, what now?

Software will never be perfect. Vulnerabilities will happen.

The real question isn’t if an attacker will find them. It’s when—and whether we’re ready.

What if the best way to prevent the next breach… is to think like the one who might cause it?

Let’s talk about it.

Share this blog article