"The fact is, if we accept Marriott’s statement that the breach began in 2014, the system would already have been operating securely for five years. It is diff

"The fact is, if we accept Marriott’s statement that the breach began in 2014, the system would already have been operating securely for five years. It is difficult to imagine how an architectural or platform vulnerability would not have been discovered or exploited sooner." Not really. There's been vulnerabilities that have been out in the wild for quite some time and took years to be found. Sometimes it just comes down to luck/what people are trying to exploit.