> The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected.

Considering downthread there are honest suggestions to send special forces after the ransomware gangs, I’m gonna go with “probably not”. That type of denial is pervasive.

The F500 and companies like JBS just need to move essentially dataframes around from automation to automation, but somehow the software ecosystem is still building that with the same tools used to write Google. The next answer is usually “they don’t invest in a security team, clearly,” and I’m waiting for that subthread to kick off, too, to continue the denial.

Software complexity is the enemy, not the malicious actors exploiting it. Fix one, fix the other.

Software complexity is hard to tackle because it's really the underlying business complexity that's being modelled, which is usually beurocratic, Byzantine-like.

See the recent post on why the Uber app is so large: https://news.ycombinator.com/item?id=25376346

I'm confused, why isn't a security team a good way to make and enforce things like smaller attack surfaces and network isolation?

It is, but it's never going to be perfect. Nobody has achieved that so far. Or at least not in an environment where you have international distribution and thousands of endpoints touching different areas of the system.

The arms race is in exploits and software development. The country with the largest stockpile of the former and the best talent in the latter will emerge the victor.

A large stockpile of exploits can only harm someone else's economy, and it does not protect your economy. So perhaps your neighbour will suffer more than you do, but none of you will be winners in any sense.

The threat of retalition is historically one of the best defenses.

With big limitations that don't apply here. Things like mutually assured destruction work if/because an attack is quickly detectable, reasonably clearly attributable, and a symmetric tit-for-tat retaliation is plausible.

That's not the case for cyberattacks. Solarwinds was attacked many months before it was detected, Stuxnet was hidden for years. We have attributed some attacks but not most and attribution often succeeds only years after detection. And the attackers aren't as vulnerable to cyberattacks simply because their economy is "less connected" - for example, North Korea is at the extreme end of that scale and they really don't care much about what exploits you have; you have a digital economy that's wealthy but vulnerable to attacks by those who don't have it.