A place I worked at fell for this AI marketing doomerism around vulnerabilitues hook line and sinker. The tool lit up the organisation's infrastructure like a Christmas tree labelling thousands of configuration issues and potential exploits, yet only a tiny fraction of was ever truly exploitable from the open internet. Millions blown on this junk and hundreds of hours wasted triaging meaningless reports all to appease an LLM that doesn't know jack shit about threat modelling. But hey executives said scary number went down and that's good right?