It seems like the Solarwinds exploit deserves inclusion on their list. The big thing about the event is you have a whole bunch of high-value-target companies wh

It seems like the Solarwinds exploit deserves inclusion on their list. The big thing about the event is you have a whole bunch of high-value-target companies who uncritically load whatever update Solarwinds (and the other proprietary vendors they use) send them. The create a huge "attack surface" and allowed the hackers to stay in the various systems for a substantial period of time. And yes, "anyone can be hacked" but if the various companies compiled their admin software from source, things would certainly be harder - even if dubious source got through, the action of the software of "phoning home" would be a lot more suspicious, etc.