I've only made up my mind to the extend that I'm naturally skeptical of anyone selling anything, and to the extent that I've worked in cybersecurity and know how the sales engine works.

Beyond that, I'm confused. OP gives data supporting the idea that security concerns have been a puff-piece PR stunt. Glasswing's numbers are fake, and beyond that why on earth would a company not divert resources to processing vulnerabilities if they were sitting on a PR goldmine?

The response is "trust me bro, I've been working hard to fix stuff for a private company." Which doesn't tell us anything.

The OP gives us ample reason to believe that this commenter has been wasted their time on non-issues caused by LLM slop-reporting. This is consistent with my professional experience (and I'm confident resonates with the experience of many who actually work in the field).

The commenter theirself just says "trust me bro, private is different from public" which I do not have reason to believe.

I work for a private enterprise that has been deluged with security issues that we are fixing while adding zero value to the company due to corporate's response to "Mythos."

We are finding that almost none of these issues are valid.

I would love - LOVE - to hear some kind of valid, quantified, well-argued justification for the titanic shift of resources away from productivity and towards security.

I would love to look at actual data, or for you to make an actual argument, or for someone to make some actual sense on the cybersecurity doomsday front. I engage in good faith with good faith arguments. I have not heard any.