Things we learned from the Log4j vulnerability:

1. You need more than dynamic analysis to solve Log4j vulnerabilities.
2. Open source analysis is critical.
3. Scale your AppSec program.