It seems you forgot to note this comment is a quote from [1].
reply1. https://labs.watchtowr.com/someone-knows-bash-far-too-well-a...
"We are aware" can mean "we are taking this very seriously and have seen very little so far" or it can mean "after covering our eyes and plugging our ears we are seeing and hearing very little of this problem".
replyAnd "a very limited number" may mean "though we pretend to be a big company, we have a limited number of customers and while they all pay licence fees, most are not actually using the product in production."
replyIvanti isn't exactly a small company. It's products are used in fair amount of the F100's out there so any risk on their part can have an outsized influence.
replyThat's why you hire a CSO: Chief Scapegoat Officer.
replyYou pay them a million per year, and fire them when a breach happens.
Way cheaper than improving security.
If you're aware of the sheer number of exploits that can work around or without authentication against anything Ivanti, it has to be the latter.
reply