> When there are major software vulnerabilities (like log4j), the whole industry usually swarms around it, and the alarm has high value. You're leaving me with

> When there are major software vulnerabilities (like log4j), the whole industry usually swarms around it, and the alarm has high value. You're leaving me with the impression that you think we should only patch major software vulnerabilities. This I would disagree with. Minor vulnerabilities can be used, especially in groups, to do things we don't anticipate. It's not just about a single vulnerability but about how an attacker can leverage multiple different vulnerabilities together.