OK, SamA, if things are that bad I have a proposal. Listen carefully, your business and future depend on it.

Meet the new net, superficially the same as the old net

How to tackle the bug backlog? It is fairly simple, we wind back the clock on network services all the way to the dawn of the 'net, replacing known-insecure things like telnet, ftp and finger with heavily audited alternatives based around ssh etc. The rule is that only audited software is allowed access to the 'new net'. Of course none of those newfangled agents and models are audited not can they be audited in any real sense of the word so unfortunately for SamA they're banished to the 'old net'. The idea would be to get the 'new net' up and running quickly and move critical services which need to be network-reachable there. It needs to be bilt in such a way that even when one of SamA's toys gets access to the 'new net' it can't do much, or anything. The 'new net' could be compared to a 'mission critical API' to essential services, useable by all who need to have access but technically off-limits to SamA's creations. They are available on the 'old net' where all bets are off and which no longer can be used to interface with critical services 'cause they're not connected and can not be connected.

Now all that's needed is to find a way how to implement this without bugs, without handing the ultimate control mechanism to power brokers, without loosing too much real functionality, without ... well, many problems. When the enemy is inside the gates half-measures tend not to work, best find him and lop his head off. Better be careful where you stick your neck, SamA.