> By a wide margin, their most impactful designed purpose is to sell security products and services The cyber causality dilemma - which came first, the vendor

> By a wide margin, their most impactful designed purpose is to sell security products and services The cyber causality dilemma - which came first, the vendor or the framework? I think there's some use for the framework to make people think about which controls and concepts might work for a given situation, but certainly they need the real world to be examined in parallel to be useful