> because old software is going to be patched or thrown away and new one is going to be security-scanned and tested.
I highly disagree with this, I've worked in many environment and I can tell you some medium/big companies do not adapt fast enough, some have multiple projects, and when someone critical leaves, many of these projects remain unmaintained but "working". If you don't have deep monitoring, you won't even detect that you've been "hacked" or "infiltrated". Companies accepted that risk because the pace from CVE -> exploitation was big enough, but now with AI, exploitation at scale is easier than ever.
I highly disagree with this, I've worked in many environment and I can tell you some medium/big companies do not adapt fast enough, some have multiple projects, and when someone critical leaves, many of these projects remain unmaintained but "working". If you don't have deep monitoring, you won't even detect that you've been "hacked" or "infiltrated". Companies accepted that risk because the pace from CVE -> exploitation was big enough, but now with AI, exploitation at scale is easier than ever.