The number of known vulnerabilities is bound to increase as IT managers continue to stuff more and more crap technology into their networks. The bigger problem however lies in the increasing number of threats regularly occurring on their networks. Too much dependency is placed on technology to keep their networks operating in a safe and compliant fashion, and they abdicate responsibility for actually knowing what's going on. Security controls, alarm thresholds and event management all use well-defined criteria to alert someone of a problem. But what about all the conditions leading up to and just below these points? Don't these conditions warrant attention? How does waiting for the event to occur help matters? The users are still reacting to a problem. But what if they could anticipate problems before they happened and could take proactive steps to avoid reaction and spend time more productively? As long as people keep buying the hype and "do-it-all solutions" at the expense of monitoring what's really happening on their network, indeed, exploits will continue to rise. But these won't be due to more vulnerabilities, they'll be because everyone does the same old thing and merely expects different results.

Click to read the article this is in response to.