That persistence isn't really a failure of tooling. It's a fact of how modern applications are built.
A typical service pulls in hundreds of transitive open-source dependencies, any one of which can carry a critical CVE that's difficult to even inventory, let alone test and ship a fix for on short notice. Now factor in what AI-assisted vulnerability research is starting to do to that timeline.
Attackers can already use large language models to trace exploit paths through unfamiliar codebases and generate working proof-of-concept variants in hours rather than weeks. If that trend holds, security teams are no longer planning for one Log4Shell-scale event every few years.
They are preparing for dozens running concurrently, each with a shrinking window between disclosure and exploitation. It just isn't enough on its own.
