> "This entirely separate attack exists therefor completely removing an entire attack primitive haves no value" It has value, but it's also true that trusting

> "This entirely separate attack exists therefor completely removing an entire attack primitive haves no value" It has value, but it's also true that trusting cloud providers serveless infrastructure introduces additional sets of vulnerabilities due to various reasons. eg: https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/ https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/ Reading your comments, I get the impression that you are used to dealing with clients whose infrastructure management skills are lacking, and they are making a mess of things. While serverless infrastructures certainly eliminate a range of vulnerability classes, it is adoption is unlikely to be sufficient to secure platforms that are inadequate for the threats they face. At the end of the day, someone has to put in the work to ensure that things are patched, safe, and secure, whether the computing model is serverless or not.