Infosec is Sick

The talk starts from the claim that information security has drifted away from its purpose of mitigating risk, and that the insurance industry is feeling the result through large cyber claims. The speaker argues that experienced practitioners are moving into management or leaving the field, leaving teams staffed with people who lack solid training. He links this to leadership incentives, where avoiding blame and keeping the board satisfied can matter more than measuring and reducing exposure. Discovering more assets can even increase a security leader's personal liability, which discourages visibility.

The middle of the talk takes aim at severity ratings and letter grades. The speaker argues that these scores do not correlate with real losses and ignore business context, and he uses simple arithmetic to show how a top-severity flaw can be priced far below the cost of replacing a laptop. He also questions averaging grades, which can reward growing the attack surface, and describes web application firewalls as hard to operate correctly and too slow to stop fresh zero-day exploits. On cyber insurance, he notes that insurers often pay claims while customers require coverage, which pushes companies to strengthen their own defenses.

The closing argument is that security should be expressed in financial terms. Remediation cost before a compromise can be compared with expected loss after one, weighted by likelihood and adjusted for company valuation. The speaker admits that existing models such as FAIR are hard to run at scale and that automation is still missing. The practical takeaway is for security teams to frame findings in business value so executives can make prioritization and investment decisions.