Judging by the comments this article seems true in the abstract: "You are only as strong as your weakest link" can be formalized better as "You are only strong

Judging by the comments this article seems true in the abstract: "You are only as strong as your weakest link" can be formalized better as "You are only strong if there is no path over your assets for an attacker to carry out their objective." The big problem with "checklist based security" is that it is agnostic to underlying infra and ignores whatever issues a graph based approach might reveal. I'll add another item that defenders use for graphs: SBOMs. You can map out component relationships with them and understand if, for example, there's an issue with openssl, note which end applications are affected.