lessonscybersecurity

26 Years In. Here's What I Actually Know.

Not a listicle. Not a framework. Just the things that have held up after a quarter century of getting punched in the face by reality.

I've been doing this for 26 years. Long enough to have been wrong about almost everything at least once. Long enough to know which lessons actually stick.

The biggest one: the attacker always has more time than you. Defense is a full-time job. Offense is a hobby. That asymmetry never goes away, no matter how good your tooling gets.

The second one: most breaches are boring. Not sophisticated nation-state operations — just someone reusing a password, or clicking a link, or running software that hasn't been patched since 2019. The exciting stuff is real, but it's rare. The boring stuff is what kills you.

The third one, and this took me the longest to learn: the humans are always the hardest part. Not the technology. Not the architecture. The people — their habits, their incentives, their blind spots. Security is a people problem wearing a technology costume.

Everything else is details. Important details, but details. Get those three things right and you're ahead of 90% of the field.