plenty more has changed. for example the barrier to being a skiddie is basically gone, and low-skill would be hackers can hit very hard. to develop a CVE into

plenty more has changed. for example the barrier to being a skiddie is basically gone, and low-skill would be hackers can hit very hard. to develop a CVE into a KEV in 2017 might take 2-3 months with a skilled team of serious security engineers; now my intern can get into police radios without knowing anything about the underlaying technology, essentially on a whim. any random tier 1 IT drone who can define a VLAN can potentially hit as hard as that team of security engineers now