This is truly getting tiresome. The effort to paint the very difficult immediate situation as without precedent and not “normal” ignores the waves of the security issues of the past. I’m not downplaying this and just as tired of “no, this time is different.” There’s just no escaping that every step function change in automated tools to find (security) holes/bugs that arose out of point experiences being generalized immediately created the type of “all hands” situation we face now. Everything from floppy disk scanning to buffer over runs to uninitialized variables to off by one loops to automation hooks to script kiddies to xss to frames to social engineering saw incidents leading to generalized tools that scanned environments to find countless latent bugs that needed to be fixed urgently. One day a product was ready to ship and then a tool ran and suddenly there were 10,000 new bugs for 500 engineers to investigate and fix and then test for what broke because well who knows what happens when you suddenly initialize a variable that wasn’t previously. This sucks in a ton of ways. No one wants to stop what they are doing at what seems like the biggest opportunity and/or disruptive risk to business in a generation. No one wants to touch old code. No one likes to have work generated for them by automated tools finding issues that are obscure by definition. But this is all good. These bugs were all there. Instead of cursing just realize how lucky your team is to find them now and not after the breach. Whenever we surfaced from these moments in the past we felt our code reached a new and better “steady state” and that will happen.