The scarce input to the vulnerability ecosystem was human attention.

[aristot73@infosec.exchange]

The scarce input to the vulnerability ecosystem was human attention. That input is no longer scarce.

The structures built on attention scarcity — pricing, disclosure norms, triage infrastructure, investment models — are breaking or bending.

The scarce input is now remediation capacity: the people, institutions, and processes that can turn a finding into a fix and get the fix deployed.

Every economic and policy question in this space should be re-read with that substitution in mind.

None of this requires haste or drama. It requires the steady, well-resourced execution of commitments governments have already made, and the discipline to resist both complacency and overreaction.