5thaccount

I've reached that point as well. Is there a preferred model and prompt you use for that?

> doesn't this feel a bit short-sighted

Absolutely feels that way... but it may also be VITAL.

The first (really only) goal of a company is to not die. I call this the SHL rule - as it was recommended several times to SHL that he kill off Gumroad.

Who can kill a company varies over time. Initially, that is likely 100% the founders. Either giving up, feuding or running out of money. Then investors/debtors have the power to kill a company off. Finally, and every company should be so lucky to reach this level, acquirers/bankers/Government can kill off a company. Making sure you don't die - and knowing who has the power to kill you off - should be prioritised at (almost) any cost.

As an example, I once had a client who spent $X0K a month on AdWords for one keyword exact matched. It generated almost no revenue. The main investor would Google this one word, and if the site did not rank 1st both paid and organic, he'd threaten to pull all future funding. The company was loss making at that time, so that would have killed it off. I moved that one keyword into it's own AdGroup, called it "Investor Relations", never talked about it again, and years later the company was sold for $X0,000,000.

Have you tried doing freelancer stuff? When no one will give you a chance, giving yourself one is probably your best bet.

I have no idea how well that would work, but it seems like the only variable you can control.

In my experience, a lot of corporate entities have bad rules like "30 days to review patches before they go live", or "no patches not reviewed by team X" that slow down changes. These sorts of caveats are both hard to change, and even harder to circumvent, because big companies make change difficult as they usually have more to lose than to gain.

If you look at the article, it matches this idea:

> ... Mr. Smith referred to an “individual” in Equifax’s technology department who had failed to heed security warnings and did not ensure the implementation of software fixes that would have prevented the breach.

I doubt one individual is responsible for every patch in the organisation, and I reckon that Equifax likely has many individuals each responsible for different systems, all of whom have to deal with a central security department before they can, well, patch their system. I further bet the internal politics are off the chart, and the security team is a "no, you can't do that" department who makes things worse.

I put money on there being plenty of "individuals" who are each responsible for patching different systems at Equifax, and while this particular breach was in system X, A-W might, at another time, have been the epicentre of a breach for similar reasons related to internal processes that make moving fast nigh on impossible.

Now, while that's no excuse, I think the fault is likely not the individual who missed the patch, but the interaction between departments with different goals (political and practical) combined with an internal structure that makes changes glacially slow, and this sort of breach inevitable.