The Cold, Hard Truth About Cybersecurity in 2024 (From Someone Who’s Seen It All)

I just got back from DefCon. Still buzzing from the hardware hacking village — there’s something about watching a security system literally ripped apart in front of your face in real-time that makes you rethink everything. But let’s discuss something I’ve been seeing way too much of late: organizations that believe themselves to be secure but are not. Because the reality is, many companies are still resting on outdated defenses as attackers continue to evolve.

I have been in this field since the early ‘90s. Saw the spread of the Slammer worm like wildfire. Managed networks in the days where PSTN was king in terms of how you connected voice / data (those were the days) And now, I own my own security company — and spend a good part of my day trying to convince people that civilian cybersecurity is not just a matter of buying that shiny new firewall.

Quick Take: The Worst Cybersecurity Blunders I Keep Observing

• Relying only on firewalls and antivirus to protect you.
• Believing that AI-driven network security means you never have to create well-defined policies.
• Using VPNs without any real zero trust concepts in practice.
• Overlooking hardware vulnerabilities (seriously, your ransomware supply chain).
• Not taking insider threats seriously (your biggest risk isn’t always an external hacker, trust me).

The Firewall Fallacy: You’re Still Not Secure

For far too many businesses, a Next-Gen Firewall serves some analogy akin to a brick wall around a castle when it comes to cybersecurity. The thing is — the attackers are not storming through your front gates. They’re slipping through side doors, taking advantage of weaknesses in legacy systems, or simply strolling in with credentials harvested through phishing.

I’ve done projects for companies who thought they were secure because they plunked down a fat stack of cash for a new firewall. But what happens when we run a penetration test? We found:

• Rules set up so poorly that it was like leaving the door wide-open.
• No monitoring — so if an attacker was poking around, no one even noticed.
• Lame segmentation on the inside, so once they got inside? They were privy to all of it.

A firewall is not a security strategy — it’s a tool. And as with any tool, it’s only effective if you’re using it the right way.

AI-Powered Security? Don’t Buy the Hype

Permit me to say something slightly controversial: I don’t trust any security solution that touts itself as AI-powered.

• AI models train on information up until October 2023.
• So are attackers, who are using AI to generate phishing emails that slip past filters, create deepfake voices for scams, and automate password cracking.
• If your security strategy consists solely of hoping that AI will identify all threats on your behalf, you’re in trouble.

I remember sitting in a room at a financial institution — a significant player — and hearing their CTO tell me that there new AI security system would completely mitigate breaches. I almost spit out my coffee. Fast forward six months, and they were deep into a damage control nightmare that could have been avoided if it had bypassed everything as a result of a social engineering attack.

There’s no AI that can fix bad security hygiene. And in cybersecurity, fundamentals are still more important than shiny tech.

Zero Trust Thanks: The Sole Pattern That Works

This is where shit gets real. If your organization still works on perimeter based security models, you are begging to be breached. Zero Trust is more than a buzzword — it’s a mindset. One I just helped three banks to implement after they understood that their VPN-based security was never going to work.

Here’s the gist:

1. Trust nothing — if a device is on your network, that doesn’t mean it should be trusted.
2. Implement the principle of least privilege — users get access only to what they need.
3. Ongoing verification — just because someone logged in once doesn’t mean they’re trusted forever.
4. Micro-segmentation — so when an attacker does get in, they can’t move laterally.

Not the simplest thing to pull off, but if you get it, right? It makes it stupidly hard for attackers to move within your network.

The Hardware Blindspot That Might Be Your Undoing

I know this part well — due to it being the time of DefCon. Many organizations concentrate on software security while completely overlooking the hardware.

Take supply chain attacks. Security at the endpoint will not protect you if your hardware was compromised before you ever plugged it in.

I’ve seen:

• Pre-installed backdoors in routers
• USB sticks offered at conferences (yes, still the thing to do).
• Security cameras uploading video to mysterious foreign servers.

If you’re not auditing your hardware supply chain you have a blindspot attackers love.

Passwords: Why Are We Still Getting This Wrong?

Rant time.

We’ve known for years that weak passwords are a problem, and yet here we are — still suffering breaches from P@ssw0rd123.

Things I wish organizations were already doing:

• Nix password expiration policies. They don’t help — just encourage users to make worse passwords.
• Embrace passphrases. Abc1esu1- Because that is a million times better than J4fi90! x.
• Implement multi-factor authentication. No exceptions. I don’t care if it’s hated by your CEO.

And don’t even get me started on those security questions that want your mother’s maiden name.

What YOU MUST DO NOW TO PROTECT YOUR BUSINESS

If you have the sense that cybersecurity is a moving target, you’re not mistaken. But, there are some fundamental things that will always make your security better:

• No reliance on passwords anymore. MFA everywhere.
• Buckle down on endpoint security. No endpoint management, no security management.
• Move to a zero-trust model. No, VPNs aren’t enough.
• Audit your hardware. Supply chain attacks are real, and they are devastating.
• Assume a breach. Prepare for incident response like it’s going to happen.

Most importantly? Don’t assume there is someone else in your organization responsible for security. That’s how you become front-page news.

Takeaway: Security Is Never Completed

I’ve been in this industry for 30 years. And I still wake up every day to those attackers adapting faster than most of the businesses. And that is why complacency is the true enemy, not just hackers.

If you come away from this with nothing else — take this:

Security is not something you purchase. It’s something you do. Every day. Got questions? Good. Keep questioning everything. That’s how we stay ahead.