Fixing everything is a fool's errand

Vulnerability management is a bit of a fool's errand if your goal is to make sure that everything's fixed. We're not going to get around to all of it. There's too much.

We've got to actually think about what our threat model is. What are we trying to prevent? What kind of attackers are we expecting, and what's their level of economically rational motivation to do the thing? Reverse out the things that are most important, make sure you're not missing that stuff if it comes in on the queue, and work backwards from that, instead of trying to eat the whole elephant and figure out which part was best.

From my conversation with Ashish Rajan on the AI Security Podcast.