On Seeing Systems

It is very easy to get caught up in the noise. Every day brings another product, another vulnerability, another headline, another promise to make security faster, smarter, or more efficient. Keeping up has become a full-time job.

But are we getting better?

Not better at processing alerts. Not better at adding controls. Not better at doing the same things faster.

Better at security.

We spend so much time improving the processes we inherited that we rarely stop to ask why those processes exist in the first place. Why do we think the way we think? Why do we use the tools we use? What problem were they originally meant to solve?

The demands of operating these systems leave little room to question the systems themselves. We know when something feels wrong. We know there must be a better way. But we are so consumed by the work in front of us that we rarely have time to question the systems, assumptions, and processes that shaped it.

There are better ways. But to move forward, we may need to look backward: to understand how we got here, why these systems exist, and which assumptions we have stopped questioning. If we want to improve as an industry, we need to return to the fundamentals. That creates space to question the assumptions we have inherited, ask better questions about the systems we are trying to protect, and find better ways to protect them.

Those systems are always changing, adapting, and evolving. We may never see them completely, fully understand them, or be able to control them, yet we can learn to see them more clearly and better orient ourselves in this ever-changing landscape.

If we want to become better defenders, getting faster at the same work is not enough.

We have to learn to think differently.