If your security program still relies on the assumption that your vulnerabilities are too complex or too hidden for attackers to find, you are operating on borrowed time.