Anton Chuvakin argues that SBOMs and vulnerability scanners like Trivy overwhelm CISOs with alerts. Instead of buying more tools, he pushes for concrete architectural changes and systematic remediation processes to actually handle what the scanners find.
So you've made me cry. You've made Anton cry. I imagine a CISO listening to this episode is probably also crying. What do they do? They wipe their tears with the S-bombs. Aside from dry their eyes on their S-bomb, what should they do if they, for example, are also crying because they found, you know, the Trivy indicators in their logs? And what's the architectural change they should make? What's the response action they should take? And please don't say buy another scanner, although I know you wouldn't do that.