Security is governance of tech, and when that clicks, it makes sense why MSFT or anyone can't just "fix" it. I genuinely dislike that company and its products,

Security is governance of tech, and when that clicks, it makes sense why MSFT or anyone can't just "fix" it. I genuinely dislike that company and its products, but releasing vulnerabilities and exploits or shipping code with risks is part of the ecosystem. The article implies it has an old way of thinking where because software is artificial we can ostensibly operate it as being a deterministic system, and that we can solve security, which is effectively a political problem of control and power, by specifying the right operations. Reality is, we have initial conditons and incentives, and what happens in between is dynamic. Governance has policy, surveillance, and enforcement, and security products fall into those buckets, with the highest value being to the latter, and the smartest being the first. Policy requires more forethought and coordination than you can reasonably expect at scale within orgs, let alone across different ones, so we (sec) sell surveillance and enforcement tools instead.