I missed working in US mega-corps. When they announce initiatives like that (with fanfare), and spend 50% of time and effort on marketing and planning, and 20%

I missed working in US mega-corps. When they announce initiatives like that (with fanfare), and spend 50% of time and effort on marketing and planning, and 20% on the actual effort (as new resources are not added and existing resources are not 'allowed' to dedicate any/much time on that latest new initiative). I was listening to Security Now a couple of weeks ago (I didn't read/research on this further) and they said that some LLM ran through the CVEs and from the description only managed to successfully create code to take advantage in 70%-80% of them. It is amusing how MS is losing the "NOBUS" game, got bitch-slapped by the EDPS a couple of months ago, and need to say/do something to save face. In Project Management the deal is "say-do-say". To what @wepple wrote above, it would be interesting to see on a semi-annual basis what the latter 'say' is (what did they actually did/and it worked). Understanding the sensitivity of security impact "hey we found XYZ vuln on ABC system" would be irresponsible for people still using said-ABC outdated system. (semi-rant, but my honest thoughts)(I wish MS the very best, I got some stocks of MS so I want them to succeed) :)