More CVEs doesn’t automatically mean more risk. In this clip, the speaker explains how Mozilla responded to Firefox sandbox escape and JavaScript prototype vulnerabilities — not by patching each issue individually, but by changing the architecture itself. They froze JavaScript prototypes to eliminate entire classes of exploits. Sometimes the real security win is not fixing bugs — it’s redesigning the system. Are security teams still over-optimizing for patching instead of architecture? #CyberSec