The Hard Truth of Cybersecurity (Somebody Who’s Been in the Trenches Since the 90s)

Funny how some things change — and some don’t. When I began as a network admin in 1993, I spent hours playing with multiplexers, getting voice and data over PSTN and praying the network wouldn’t go down overnight. Security was a whole other beast back then. Firewalls? Sure. But zero-trust? AI-driven security? These were things from science fiction. Now I have my own cybersecurity consultancy, and I work with businesses — particularly banks — to secure their networks before an attacker does.

I’ve just returned from DefCon and am still buzzing off of the hardware hacking village (it’s amazing what people can accomplish with a handful of lines of code and an old hunk of silicon). After my third coffee of the day, I thought to sit down and discuss what’s truly going on in the cybersecurity world—what works, what doesn’t and what keeps me up at night.

Quick Take: What You Need to Know If You Read Nothing Else

Little did I know at the time how troubling that request would be, how dangerous this tech development would become — and that I’d soon learn a new kind of developer was rising. Hackers are automating attacks like never before: Services on improperly configured systems are compromised by bots and AI-driven malware in less than a second.

• Zero-trust is not optional: If you’re still defending primarily the perimeter—you’re good if the bad guys are out there and the good guys are in here—you’re already compromised.
• Your biggest risk? Your own employees. Insider threats are as bad as ever whether it’s phishing, weak passwords, or just sheer negligence.
• Patching remains a nightmare: I don’t care what advanced security looks like, if you’re not patching on a regular basis, everything else is just wasted effort.
• AI-driven security is a false marketer. There, I said it. AI can assist, but it’s not about to take the place of good old-fashioned security practices anytime soon.

Let’s Talk About Attacks — And How They’ve Changed

When SQL Slammer struck in the year 2003, we all felt the world catching fire overnight. Networks became overloaded, banks went dark, and I found myself having to explain to a very irate CIO why traffic had ground to a stop. Fast-forward to today, and the threats have evolved — but, in some ways, they haven’t.

Unpatched systems are still being exploited by hackers. They depend on bad password hygiene as it stands. And they still weasel their way into organizations by conning employees. The difference? It’s now automated. The threat actors aren’t sitting behind keyboards, they’re deploying bots that discover and exploit vulnerabilities at scale.

What This Means for You:

• If you’re not patching critical vulnerabilities for a period of 24-48 hours? You might as well keep the front door open.
• Are you supporting MFA on every critical system login? If not, you are living in the past.
• If you still let employees re-use passwords? You’re asking for an attack. (And yes, password managers are helpful, but they’re not magic.)

End the Fantasy That the Firewall Is Enough: Zero-Trust

I’ve assisted three banks in modernizing their security architecture this year by transitioning from dated architectures to zero-trust architectures. And the thing is — most people at most companies are still doing security wrong.

They assume a firewall or VPN will suffice. They assume, when an attacker does break into the network, that authentication will prevent further access. But that’s not the way that modern attacks function.

Reality Check:

• Trust no device, trust no user. Yes—even internal employees.
• Use least privilege access—not everybody requires admin rights. In fact, very few people should have them.
• Monitor everything. Logs save lives. To not be collecting, looking at logs is flying blind.

Zero-trust isn’t about trusting no one; rather, it’s about validating every action. If someone logs in from a nefarious country at three A.M., don’t follow through on their request without further verification, perhaps?

Your Employees Are Your Weakest Link: Insider Threats

This one will never change. As security gets smarter, humans still fail for phishing emails. Passwords will be from sticky notes, still. And social engineering will continue to be used to circumvent all those costly firewalls you paid for.

I performed a Red Team assessment for a financial institution several years back. No need to bother writing a line of malicious code. You know what worked? Some phony UPS delivery man comes in and “needs access to check a malfunctioning printer.” The best social engineering you can do.

Make This Right Before It’s Too Late:

• Security awareness training is not negotiable — not once a year. Constant reminders.
• Restrict access to sensitive data. The fewer employees with access to critical systems the fewer leaks possibly.
• Phish your own employees. Seriously. Practice attacks internally and see who bites—then train those people.

Patch: What Are We Still Talking About Here?

I get it. Patching is annoying. Every administrator has faced that specific patch that ruined everything. But here’s the reality — unpatched vulnerabilities are responsible for casting a shadow over almost every significant breach. We heard of Log4j vulnerabilities months before they would be exploited, and yet many companies still didn’t fix it in time.

This isn’t complicated:

1. Have a patching policy automate updates where you can
2. End-users updating their systems is not going to happen (they won’t).
3. When a patch is unavailable, institute compensating controls (such as WAF rules or network segmentation).

In the cybersecurity universe, it’s patch now or get breached later. There’s no middle ground.

AI in Security | The Lowdown: Overhyped & Misunderstood

Now listen, there is a role for AI in security. It aids in anomaly detection, pattern prediction, and even response automation. But I’m wary of any solution that is marketed as AI-powered cybersecurity.

Why? Because attackers understand how these systems work — and they’re already coming up with ways to get around them. AI will complement security teams, but it’s not going to take their place:

• Threat hunting driven by humans.
• Security policies configured properly.
• The importance of good cybersecurity hygiene.

If you think you are going to leave it to AI to protect your business, you are going to have a very bad time.

Final Thoughts: Security Is Hard, But You Don’t Have A Choice

Every year I visit DefCon, I’m struck by just how quickly security is advancing — and just how far behind so many businesses still are. And attackers aren’t going to wait around for you to catch up. They are innovating on a daily basis, automating their exploits, and absolutely testing every little misconfiguration.

If you learn only one thing from all of this, let it be this:

• Secure up: zero-trust + MFA + patching policy + defensive policies are a must. They’re non-negotiable.
• Train your employees. If someone gets caught in a phishing scam, your firewall won’t protect them.
• Talented attacks will get more complex. Stop assuming today’s defenses will protect you tomorrow.

Cybersecurity is not just an IT problem. It’s a survival issue. And if you’re not adapting, you’re already the target.

Now, if you’ll excuse me, I need a cup of coffee.