The Paved Path: Making the Secure Choice the Easy Choice at Scale

Fri, 01 May 2026 00:00:00 +0000

This is the final part of a series. Start with Part 1 — giving the backlog teeth, then Part 2 — the waiver trap.

The waiver experiment was a failure in the best possible way; it was diagnostic. It told me exactly where the real bottleneck was: fixing a vulnerability was hard to do, not hard to decide. Teams weren’t ignoring the work because they were lazy or uncaring. The work to fix a dependency vulnerability was slow, manual, and painful. Every fix was a research project.

So I stopped trying to apply more pressure and started asking the question that changed everything:

What if fixing a vulnerability was the easiest possible thing to do?

Change Management on Cliff Hults

The Paved Path: Making the Secure Choice the Easy Choice at Scale