Security on Cliff Hults

The Paved Path: Making the Secure Choice the Easy Choice at Scale

Fri, 01 May 2026 00:00:00 +0000

This is the final part of a series. Start with Part 1 — giving the backlog teeth, then Part 2 — the waiver trap.

The waiver experiment was a failure in the best possible way; it was diagnostic. It told me exactly where the real bottleneck was: fixing a vulnerability was hard to do, not hard to decide. Teams weren’t ignoring the work because they were lazy or uncaring. The work to fix a dependency vulnerability was slow, manual, and painful. Every fix was a research project.

So I stopped trying to apply more pressure and started asking the question that changed everything:

What if fixing a vulnerability was the easiest possible thing to do?

The Waiver Trap: When Your Compliance Safety Valve Delays Real Remediation

Fri, 13 Feb 2026 00:00:00 +0000

Enforcement worked. Critical vulnerabilities were suddenly getting fixed on deadlines, and the backlog that had sat ignored for years started to clear. But it worked too well in one sense: the volume of new work it created across thousands of developers turned enforcement itself into a blocker.

This is the part of the story almost nobody writes about, because it’s the part that looks like a failure. It was the most instructive decision I made.

Giving the Backlog Teeth: What Enforcing Remediation SLOs Actually Requires

Fri, 06 Feb 2026 00:00:00 +0000

Every security leader has stared down a backlog of ignored vulnerabilities. You know the shape of it: thousands of open findings, tracked diligently, remediated rarely. The problem wasn’t that people didn’t care; it was that nothing was at stake for not fixing them.

I led a vulnerability-management program across a large engineering organization of thousands of developers and repositories. Early on I learned that you can’t improve what you don’t enforce. Here’s what actually happens when you give the backlog teeth, and the uncomfortable truth about what enforcing it really takes.