Modern computer systems rely on technology that wasn’t built with security in mind. Over the years this technology has evolved to incorporate security and to deprecate insecure features. The way these systems are built has also evolved and modern developers have the tools to provide a secure starting point for the projects. All of this is bolstered by a security industry and community that is much more open and active in helping to identify and resolve security vulnerabilities.That’s great for modern developers working on new projects, or for mainstream software, but there are a huge number of business critical products that pass under the radar and leave large businesses wide open to compromise - enterprise software. Many of these products began life in the early days of the information age and today are some of the largest, and most complex software products available to businesses. They often come with a hefty price tag, the great enterprise paywall, or are only available to known and established businesses operating within a specific industry. This puts them way beyond the reach of security researchers, and potentially even shelters the developers from dealing with security vulnerabilities.On the other side of the great enterprise paywall are developers who are either not security aware, or who stubbornly stick to their ancient development traditions as technology and development practices evolve. Deprecated features and practices remain in use or are re-implemented. Mitigations for security risks are reversed or disabled for the convenience of the developer. Insecure default configurations are favoured for the user experience or for backwards compatibility.This talk looks at a range of real world examples of trivial high-impact vulnerabilities affecting enterprise and specialist software, intertwined with examples of insecure development practices that keep on coming back, before finally looking at how today’s security industry can and should be working to improve the situation.