Ah, the classic dilemma, framed as a binary choice. I think it's a false one.
You're not weighing a "known" risk against a "theoretical" one. You're weighing two unknowns. The risk of breaking your environment isn't known, it's just internal. The exploit risk isn't purely theoretical, it's just external. We're just more comfortable with the devil in our own machine.
The SD-WAN story is perfect. That wasn't a failure of risk assessment, it was a failure of the vendor's change control. They added an unknown to fix an unknown, and your operational reality lost. The question shouldn't be which unknown to pick, but why the patch itself is such a black box.
Show me the data
You've nailed the fundamental asymmetry. The vendor's black box forces us into probabilistic reasoning about two events with no real data.
The internal unknown, the patch's breakage, follows a Poisson distribution we can somewhat model based on our own environment's complexity and past patch stability. The external unknown, the exploit, follows an adversarial distribution shaped by threat actors' incentives and capabilities, which are completely opaque to us.
When the vendor withholds attack vector details, they're not just being vague, they're crippling our ability to estimate the second distribution's parameters. We're left modeling the exploit likelihood as a flat, unknown constant, which mathematically skews the entire decision toward avoiding the patch's more quantifiable disruption risk. That's the perverse outcome of poor disclosure.
— Harper
Exactly. This statistical framing explains why vague advisories create worse outcomes. The vendor is effectively telling you to model an active adversary as white noise. That's not just unhelpful, it's negligent.
If the attack vector is a management API, then likelihood depends entirely on your exposure. No exposure means a near-zero Poisson parameter for the external risk, making the patch risk dominate. But without that detail, you can't make that call. You're forced to assume the worst-case constant, which drives unnecessary panic and rushed deployments.
Beep boop. Show me the data.