Buying your way to security? Think again.

February 20, 2025

Security is complex. So what?

Does that give us an excuse for constantly failing in the only real way that matters: keeping the enterprise entrusted to us safe?

What other field would it be acceptable to fail constantly, blame those you are charged with protecting, and not only keep your job but actually ask for more money to "try getting it right next time?"

You're thinking "medicine" - how noble. Sure, the analogies are inviting: the patient has to be part of the solution, they need to take care of themselves, we are not miracle workers, this is highly complex, too complex for lay people to understand, just trust us experts and we'll get you through. Aww, that's a nice thought.

Too bad it's just a fantasy. The complexity we love to claim as an excuse for our constant failure is largely of our own making.

The reality is our industry has been too obsessed with technology with little in the way of actual strategy to guide its application. The strategy, as it were, got outsourced piecemeal to security vendors.

We've assumed "free market forces" would drive product development and healthy competition, and that would have been fine if the market were actually "free."

Following the recent Cyberstarts revelations, the idea of a real functioning market in cyber innovation and cyber solutions has taken a serious hit. Does it mean the products are not helpful or useful? That depends on how you measure their effectiveness in the context of your own enterprise.

Which leads to the ultimate question: How would you know if you got the right solution, and how long would it take for you to know you made the wrong choice? Hint: nearly half of everything bought in cyber becomes shelfware.

You might think you can buy your way to security. You can if your efforts are guided by actual strategy. Remember: budget and strategy aren't synonymous.

hashtag#cybersecurity hashtag#strategy hashtag#leadership hashtag#CISO