A diffuse landscape, fruitful targets, companies not stepping up, AI’s influence and flagging U.S. government efforts all figure into a shifting threat.

The flaw in the widely used open source software package was expected to be the next great catastrophe in computer security.