> While Equifax’s Countermeasures team is responsible for writing, testing, and installing signatures and rules ... With so many articles talking about Equifax

> While Equifax’s Countermeasures team is responsible for writing, testing, and installing signatures and rules ... With so many articles talking about Equifax's incompetence, I guess I'm a little surprised that they even have a Countermeasures team. > ... his office was using two different versions of Struts and that neither was among the versions listed as vulnerable in the alert. He requested confirmation that his conclusion was accurate and noted that the business impact could be quite heavy if he was incorrect. Sadly, the business impact ultimately seems much less significant than you might imagine. > The senior manager that the developer ultimately reported to did receive the alert but did not forward it to the developer or anyone else on the developer’s team. As a result, this developer did not receive the GTVM alert about the Apache Struts vulnerability. I wonder if individual devs could/should subscribe to these CVEs? Is that possible? Not that this dev should have, but that you might want not want to rely on your company's bureaucracy to figure out important stuff like this.