The economics of cyber vuls are off:
- Researchers are incentivized to hype findings to get a higher impact score.
- Orgs are incentivized to use minimally trained staff and tools.
It all gets dumped on vendors to RE the tools and research, often showing nothingburgers.