Commercial software has become extremely complex. We don’t know what it contains, what it runs, what it connects to or, what data it may be exfiltrating. We assume its security integrity but cannot verify it. The problem is one of economic incentives. The market rewards vendors who can quickly launch software with new features. It rewards products that covertly collect and transmit user data. The market does not reward security or privacy. The market does not reward transparency or resiliency. The market prioritizes profit over security. Why do we fail to recognise this?

This presentation explores our significant reliance on vendors and the premise that the products we purchase from them do not provide attack vectors to our systems. It specifically highlights the vendors we purchase security products from to protect our systems from breaches. Should we place our trust in these vendors - or should we place them on our risk registers?