Meanwhile I have customers running legacy web apps last compiled over five years ago on end-of-life operating systems… and it’s crickets chirping. Dead quiet, not even a hint of an attack, let alone a breach.

I expected them to have been hacked to pieces by now, but even “maximally vulnerable” internet-facing apps seem to be relatively unmolested so far.

Maybe it’s still too expensive to go after “boring” enterprise targets? Maybe the bad actors targeted crypto systems first for the immense payoffs, if successful?

> it’s still too expensive to go after “boring” enterprise targets?

The economic argument seems convincing to me. I can’t tell what your stance on it is.

You’re the only one that knows the value of these targets, but “not worth it” seems likely to me.