Lean Software ■ Audited 26 August 2026
The dashboard reported thirty-eight new vulnerabilities on Monday morning, in a project whose code had last changed on Friday afternoon. Nothing was built over the weekend, nothing was deployed, nobody touched a file. The attack surface grew anyway, quietly, the way a garden grows: because almost none of it was planted by you.
That is the product working as designed, and the invoice deserves a proper audit.
A chain of custody, signed by nobody
Walk the supply line of one ordinary container backwards and count the signatures. A distribution maintainer assembled the userland to the best of their knowledge, for their own release schedule and their own threat model. An image author picked that distribution from a list of suitable bases, added a server and moved on. A software vendor picked the image from another list and bundled it under their product. An operations team pulled the bundle because the vendor said so. Four handovers, and at no station did anyone audit what the previous station had chosen; a routine census of one popular official image this week found 151 packages and 324 executables inside, in the service of a single server. Each of those packages ages on its assembler's schedule, patched according to a stranger's judgement, and run in production by people who have never read its changelog. A Linux userland in this re-assembled, unexamined form is a liability wearing the costume of an asset, and the costume is what shipped.
The public ledger that was supposed to keep watch is meanwhile drowning in its own paperwork. CVE submissions grew 263 per cent between 2020 and 2025. The National Vulnerability Database enriched a record 42,000 entries in 2025 and still ended the spring with 25,000 unprocessed; in 2026 it announced, in the politest possible language, that entries below certain criteria would remain listed but unexamined, as "lowest priority". The register of record has moved to triage. Everyone in the trade knows it, and an entire industry grew in the gap.
The honest half of the invoice
The audit rules of this column demand the credit side first, and it exists. The visibility problem is real. Nobody reads 151 changelogs per image per week, no team of any size can, and the scanners genuinely see what no human looks at: the transitive dependency four levels down, the base layer that quietly went end-of-life, the package that changed owner last month. When the alarms are right, they are worth the year's fee in an afternoon. The engineers who build these tools are solving an honest problem with honest work, and the register's collapse makes their private catalogues more valuable, which is nobody's fault at these companies.
The trouble begins one step further on, where the incentive lives.
Who profits, and who pays twice
Follow the money through the alarm business. Snyk has raised about 1.3 billion dollars and was valued at 8.5 billion at its peak, on the way to roughly 326 million in annual recurring revenue; list pricing opens at 25 dollars per developer per month and lands, in the bundles organisations actually buy, somewhere between 52 and 98. GitHub bought Dependabot in 2019 and gives it away, which prices the alarm at zero and collects in platform attachment instead. The analyst houses put the sector's growth between 16 and 18 per cent a year through the early 2030s, and that forecast is the quiet part said out loud: a market projection for confirmation is a bet that the holes will still be there in 2033. A vendor who ended the problem would be ending the subscription.
The premium tier gives the game away. The industry's newest selling point is reachability analysis, the ability to tell you which alarms concern code your application can actually execute. Read that as a product manager wrote it and it is a feature; read it as an auditor and it is a confession, because a filter against your own alarm flood only sells if the flood is mostly noise, and the vendors now price the filter separately. You pay once to be alarmed and once more to be un-alarmed, and the meter runs monthly either way.
So the bill lands three times on the same desk. The subscription itself, per developer, per month. The triage, because every alarm that is technically true and practically irrelevant still costs an engineer's attention, and attention is the scarcest thing on the floor (the alarm that matters arrives in the same inbox as the two hundred that do not, wearing the same severity badge). And the confirmation itself, which is the strangest line item of the three: the product's core deliverable is a monthly, beautifully formatted restatement of the fact that your stack contains software nobody in your building has examined. The hole stays open, freshly inventoried. Closing it remains your job, on your time, and next month the inventory arrives again.
A market projection for confirmation is a bet that the holes will still be there in 2033. A vendor who ended the problem would be ending the subscription.
The smaller way to live
There is a smaller way, and it has been shipping longer than the alarm industry has existed. FreeBSD keeps its base system and its packages in separate trees, the ports tree is curated with checksums as one collection under one project, and the audit function the industry sells as a subscription exists there as a base-system command: pkg audit checks the installed packages against the project's own vulnerability register, free, offline if you like. That does not make anyone invulnerable, and nobody serious claims it does. It changes the arithmetic further up: where the userland is one examined tree instead of four unexamined handovers, there is simply less unexamined material for anyone to bill you about.
Everywhere else, paying monthly to be told the roof still leaks would be considered eccentric. In software it is a growth market.