Running in Circles You are lost in a security rabbit hole, and you are not getting any closer to being secure. You think you are making progress, but you are not. You keep investing in products and services, yet your risk remains the same. The reason is simple: you are taking the entirely wrong route. […]
I have spent years watching organizations waste thousands of hours on vendor security assessments that produce nothing but noise. They send out hundred-question questionnaires. They demand SOC 2 reports. They ask for ISO certifications. They request NIST maturity scores. And at the end of all that paperwork, they still have no idea if the vendor […]
we love buzzwords in cybersecurity. every few months the industry discovers a new shiny acronym, slaps it on the same old product, and suddenly we’re all supposed to believe the world has changed. now the magic word is “AI.” everything is “AI-powered,” “AI-enhanced,” “AI-driven.” but when you look under the hood, most of these so‑called […]
recently I heard someone confidently say: “you don’t need to learn how to code anymore. nobody needs to. AI will do it for you.” this is exactly the kind of thinking that keeps pushing us further away from understanding the root of anything. if we follow that logic, then we also don’t need to teach […]
The illusion of independence In 2025, the industry still repeats the same mistake: letting the same hands build the system and then “validate” it. That is not validation. That is self‑comfort. A consultant who deploys your environment cannot be the one who tests it. A builder cannot be the judge of their own shortcuts. A […]
Having conducted research in computer security since 1989, I have organically learned what research truly is and what I expect from it. To start with, perhaps it’s easier to say what is not considered research. These days, when people talk about research, they’re simply referring to Googling, or better yet, ChatGPT output. Neither is research. […]
The Excitement Is Premature Everyone wants agentic AI in security. Autonomous actions. Self-healing systems. Machines making decisions… Sounds efficient. Sounds inevitable. But are you ready? Or are you just tired of doing the work yourself? “Automation without understanding is just faster confusion.” The Missing Foundation It may sound strange, but if you have never experienced […]
Can you be a cybersecurity professional just because you are passionate about it or overnight got a certificate? Real quick answer: NO, not at all! That is actually one of the main reasons behind hackers being always ahead of the security community. I hear people in this industry, well, I should say in this commercial […]
most security solutions are like traditional painkillers, we certainly feel better after talking them, but the root cause of pain remains intact and unresolved! as long as we do not address root cause of security incidents and vulnerabilities, we will be feeling better from short-term pain relief of “Security Solutions” and then suffering again soon […]
I was shocked when I heard from a “security professional” that using dark web as means understanding cyber threats has been Just Recently been discovered by them as an effective defense mechanism! no kidding! then why we are surprised we get hacked by the most trivial TTP out there? this is very disappointing that “security […]