I've been coming to a similar conclusion. In recent consulting memory, I have seen enterprises with thousands of EoL Windows 2008 servers and vulnerabilities th

I've been coming to a similar conclusion. In recent consulting memory, I have seen enterprises with thousands of EoL Windows 2008 servers and vulnerabilities that won't get patched until a catastrophic event forces the businesses to replace them. There is a trope about suppressing forest fires that has come around in a few different areas, where by suppressing forest fires with controlled burns of scrub the only fires that do occur are the ones that consume the fuel-intensive old growth forests creating super infernos. Nassim Taleb talks about it in the context of "suppressed volatility," where most attempts to reduce volatility in complex systems just cause risk to bottle up, as though there were a law of "conservation of risk," at play. We don't have "more hackers," right now because the incentives just aren't worth it. Oddly, enforcement of hacking laws and high profile busts of worm/malware writers have had the effect of discouraging the low level hacking that would clear the scrub out of corporate networks - leaving a lot of super vulnerable and unmaintained infrastructure tucked away behind forgotten firewalls. I have been trying to figure out how to get positioned product wise for this next extreme event, which I think will be caused by all these crappy security controls that removed the low hanging fruit while letting massive data risks age into a super fuel for a tail risk event. Gaming out the scenario of what companies will need when all that old infrastructure in-effect goes up in flames mainly yields migration tools for legacy code into containers that can be moved into cloud environments in a forced move, un-sticking vendor lock-in, BYOCredentials, some kind of liability mitigation for all the PII it will compromise and customer alternatives to locked in dependencies, etc. From a product perspective, I have a contrarian view where I'm less interested right now in what people in companies say they want, and more in how to be positioned for the Forcing Function event that their risk exposure has them set up for. Enterprise demand is a synthetic effect of political positioning and leverage, and not user desire that startups and consumer products respond to. Forest Fires: https://www.nature.com/articles/s41467-020-15961-y https://www.nature.com/articles/s41467-020-15961-y Taleb riffing on a similar theme via FSBlog: https://fs.blog/2012/11/learning-to-love-volatility/ https://fs.blog/2012/11/learning-to-love-volatility/