Why are people still trying to defend tomorrow's infrastructure with yesterday's thinking? We've spent…
James W. — Decision Intelligence Executive
Why are people still trying to defend tomorrow's infrastructure with yesterday's thinking? We've spent decades building careers, architectures, security programs, and entire industries around assumptions that made sense when we controlled the network, owned the infrastructure, and could reasonably identify where our boundaries existed but many of those assumptions have outlived the environments that made them useful. That disconnect is costing us.
We still have conversations about security boundaries as though geography determines trust, treat identity as something that belongs primarily to people, and build detection strategies around infrastructure that may only exist for a few minutes. Meanwhile, our businesses are operating across cloud platforms, APIs, third-party integrations, autonomous agents, and increasingly complex dependencies that don't particularly care where we drew the network perimeter.
What's interesting to me is that the technology isn't our biggest obstacle anymore; our reluctance to question the assumptions is. I understand why that happens, because experience creates confidence, and confidence can become a liability when the environment changes faster than our willingness to reconsider what we think we know.
From a CTI perspective, this becomes particularly concerning when we're still organizing defenses around yesterday's attack surface while adversaries are already exploiting the relationships between identities, services, data, automation, and business processes and the business impact goes well beyond missing an attack. We're investing in controls that protect diminishing portions of our environment, creating friction around legitimate innovation, misallocating security budgets, and making decisions based on risk models that no longer accurately represent how the organization operates.
I'm not suggesting we abandon foundational security principles, because identity, least privilege, segmentation, visibility, and defense in depth remain incredibly relevant. What needs to change is how we apply them, what we consider an asset, where we establish trust, and how we measure whether our investments are actually reducing risk.
Maybe we need to become a little less protective of the architectures we know and a lot more curious about the environments we're actually being asked to defend. The purpose of cybersecurity isn't to preserve the way we've always done things; it's to enable the business to operate, adapt, and grow without accepting unnecessary risk. I wonder how much of what we currently call a cybersecurity challenge is actually just inability to let go of an outdated mental model and embrace the unknown change of the future.
5 reactions · 1 comments
Comments
Schomer: Spot on, James. The fundamental disconnect is that we are still treating security as a perimeter problem when it’s actually a runtime tracking problem. When microservices and ephemeral infrastructure only exist for a few minutes, downstream detection strategies are already obsolete before the logs can even sync [Other Google Activities, Other Claims]. True modernization requires moving away from r