>Who exactly is responsible for unrecognized vulnerabilities? Everyone? No one? Here's a quote from Equifax's early release on the breach [0]: Equifax said th

>Who exactly is responsible for unrecognized vulnerabilities? Everyone? No one? Here's a quote from Equifax's early release on the breach [0]: Equifax said that, it had hired a cybersecurity firm to conduct a review to determine the scale of the invasion. So, to your question, I'm going with "no one", at least internally. It's beyond belief (well, not really anymore); but, not only do they not have security covered internally (criminal in itself), but they don't even appear to have a regularly engaged cybersecurity firm. They had to go out and hire one post facto. [0] https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628 https://investor.equifax.com/news-and-events/news/2017/09-07...