Literally they don’t have a choice but replace hardware. These are systems connected to our power grids, and nuclear control systems. As a computer scientist who hates cyber but has interned in cyber I can promise you our biggest issue is the people who control the cyber people. For example, my boss at my internship wanted me and another intern to develop an automated security tool that looks at supply chain, cves, and other security metrics to determine a systems hardened-ness. The one thing I remember telling my boss was “the second you make a database full of supply chain information, is the second that we’ve made the most desirable database in the world for foreign state actors”. My boss excoriated me for being insubordinate, but in light of the solar winds hack I feel like my comments at an intern were well founded. Not to mention 2 interns are not qualified for addressing this issue especially when the data we are working with is ridiculously abstract. There are so many pitfalls in the system, and the longer we fully ignore that this is a management issue and not a systems issue the better. We know how to lock down systems, the desire to make things more convenient should not exist in weapons manufacturing or too secret work. Walk your ass to the server room if you are using computers for national security.