The article 'No Exploits Required' by Tod Beardsley reflects on four decades of incident response experience, concluding that exploits are often symptoms rather than root causes of cybersecurity failures. Despite the importance of CVEs and patching, the fundamental issue lies in the architecture of modern TCP/IP networks, which inherently expose systems to the internet and allow broad connectivity. The piece notes that in 2025, only 32% of initial access vectors involved exploits, meaning over two-thirds of breaches leveraged other means such as misconfigurations, network exposure, or human errors. Zero-trust remains aspirational due to legacy constraints and operational realities. The network protocols themselves actively work against strict segmentation, making breaches more likely without requiring technical exploits.

The impact described is a systemic security challenge where attackers can gain initial access and maintain persistence without exploiting software vulnerabilities. This increases the attack surface and complicates defense strategies, as traditional patching and vulnerability management address only a portion of the risk. Organizations remain vulnerable to breaches caused by network exposure, misconfigurations, and human factors, which are not mitigated by applying patches alone.

No specific patches or fixes are applicable as this is a strategic and architectural issue rather than a discrete vulnerability. The article implies that mitigation requires adopting comprehensive exposure management, improving network segmentation, implementing zero-trust principles where feasible, and addressing human and operational factors. Organizations should focus on smart and creative approaches to managing network exposure and access controls beyond just patching vulnerabilities.