Word the Gap: The Hard Truth About Cybersecurity

It’s been quite a journey since my early days as a network admin back in 1993 — when dial-up was king and securing the perimeter by throwing up a decent firewall seemed sufficient to keep the bad guys out. Spoiler: it wasn’t. Fast-forward to now, and I’m running my own security company, facing down threats that make the Slammer worm look like a scooby-snack (yes, I was there for that one too).

I’ve just stepped back from DefCon, that frenzied church of hardware hacking village, and let me tell you—if you don’t have a couple of staff thinking about firmware security, you are already two minutes behind. But let’s address the elephant in the room.

I’m noticing more and more businesses half-committing to security right now — particularly banks, law firms, and SaaS companies that really should be too smart to do that. I just helped three banks remake their zero-trust architecture over the past months, and what I saw scared me.

So, let’s break it down. Here’s what to worry about in cybersecurity today, and what’s complete nonsense.

Overview (For the Busy Bees)

If you are short on time, here, in as few blunt bullet points as possible, is the state of play in modern security:

• Zero-trust is not a buzzword — it’s survival. If you are still clinging to an approach around VPNs and perimeter security, get up, wake up.
• Passwords are the answer to one detective agency; MFA mandatory, and yes people still resist passwords stored in spreadsheets (I almost flipped a table over this last week).
• AI-powered security? Ignore the buzz. In many ways, it is just frilly automation. What we really need is humans thinking and acting like attackers.
• Your supply chain is your greatest unknown risk. Not vetting third-party vendors enough will get you hacked.
• The next big attack surface is firmware security. If you aren’t protecting your routers, IoT devices, and hardware, you are creating a huge blind spot.

Alright, if you’re still with me — now are we really going to get into it.

What’s Really Working in Cybersecurity Today

1. Zero-trust Not Just Another Acronym

Initially, I was skeptical of the zero-trust model — we thought in the old days that a decent firewall and good passwords would suffice. But after working with dozens of finance clients, I can assure you that if you’re not employing zero-trust, you’re making yourself a target of opportunity.

Real example? One bank I’ve worked with still had an internal application which was accessible with a simple VPN. Meaning? If the credentials of an employee leaked, attackers could easily roam the halls of the system unopposed. We implemented:

• Micro-segmentation: To ensure that even when one segment is breached, the others are still secure.
• Identity-driven access controls: not role based. Identity-based — which is to say, it’s not just verified at login, but continuously.
• Least privilege enforcement: Employees hated this, but you know why? They don’t require admin rights in their email clients.

If zero-trust seems excessive, you likely haven’t experienced a breach — or worse, you didn’t detect the last one.

2. The Password Problem (And Yeah, It’s Still a Problem)

Let me repeat: your passwords are terrible. And I don’t mean just employees who use P@ssw0rd1. But the bigger issue is password reuse.

A few months ago I ran a data leaks test for a mid-sized law firm. Within moments, I had found their CFO’s credentials leaked in a previous breach. That same password?… For internal payroll access.

Take a guess how long it took me to turn that into full admin access?

Under an hour.

Here’s what you need to be doing today:

• Enforce password managers. Cease allowing people to save credentials in Notes apps.
• Turn on MFA everywhere. Yes, even for internal tools. Particular for internal tools
• Leave behind SMS based authentication. If they can SIM swap your text-based MFA does nothing.

Are you still using just passwords? You’re already compromised.

3. Yet Another Reason to Lay Off the 2% Milk

Every booth at DefCon this year was offering up some AI-enhanced security solution. My reaction? Doubt—almost skepticism, disbelief.

Why? Because, while AI can assist with pattern recognition, most of these tools merely churn out alerts — without addressing fundamental security gaps.

Here’s what’s really useful in AI security today:

• Weird behavior detection: Not everyone works in a weird way.
• Automating repetitive tasks — While faster response to an incident is good.
• Lowering false positives: All right, this one could actually help.

And here’s something AI won’t do for you:

• Find brand new exploits earlier than human researchers
• Cause a splash in cybersecurity in place of real teams.
• Catch up with adversaries who—let’s face it—are leveraging AI better than you are.

Bottom line: AI will not solve the world’s problems. Stop drinking the marketing Kool-Aid.

What Most Companies Overlook (Until It’s Too Late)

Sometimes security is less about the shiny new tools, and more about not overlooking the boring stuff.

1. Routers and Firewalls in Need of an Update

The grim lust and despicable way a commanding 20 years of businesses still depend on decrepit firewall, unpatched routers, and jaded firmware. If they gain a foothold—any old neglected IoT device will do—they own your entire network.

Check these now:

• Is your firewall actually configured right, or just left at defaults?
• Do your routers have the latest firmware? (Hint: Probably not.)
• Have you segmented IoT devices from your core infrastructure?

If your firewall still uses default credentials, just set the firewall on fire and buy a new one.

2. Your Vendors Are The Weakest Link

Recall Target’s breach of 2013? The third party was a compromised HVAC vendor. Every day, the same thing happens — only quieter.

Case in point: I have one client that was pretty secure internally. But guess what? An API vulnerability in their inventory management SaaS that was huge and unpatched. Which means attackers might have swiped customer data — and take a wild guess who would’ve been blamed?

Not the vendor. You.

Always ask vendors:

• What sort of security policies they have.
• They’ve had recent penetration tests (and can prove it).
• If they store your data encrypted, both in transit and at rest.

Your weakest partner is your weakest link in security.

Final Thoughts

So cybersecurity isn’t something to check off on a compliance list — it’s an ongoing fight against threats that don’t punch the clock.

• Zero-trust is real. Implement it.
• Passwords suck. Move beyond them.
• AI is marketing fluff — for the most part.
• Your routers and vendors will betray you if you’re not careful.

I’ve been in this game long enough to have the same mistakes repeat and repeat. Learn from them now, while you still can — or you’re the next phone call I get after something goes catastrophically wrong.

If you give a damn about cybersecurity, show it. Before it’s too late.