This is also true for software production: we have made writing and deploying software so easy to do that the rate at which training of software developers to produce PRs has outpaced the ability for systems either human or automated to handle managing the introduction of risk in all this new code.

This talk [1] by by Mark Sherman of the Software Engineering Institute at CMU is about as dark as the summary of injuries Tim presents in his post. He mentions there are on the order of hundreds of thousands of CVE reports that there are neither time nor money to triage.

[1] https://www.platformsecuritysummit.com/2019/speaker/sherman/