Persistent vulnerabilities don’t signal stupidity. They signal friction. Reports fail to create motion, deep fixes threaten deadlines, retesting rewards cosmetic changes, and incentives drift out of alignment while the calendar marches on. Treating persistence as a moral failing produces theater, not security. Treating it as a systems problem produces progress. That means tying findings to owners who can act, writing remediation guidance that fits the codebase, tracking classes of weakness rather than single instances, and measuring time-to-fix with the same seriousness as time-to-market. The organizations that improve stop asking why a bug survived. They ask which part of the machine is still feeding it.