Published Monday, August 10, 2026 at 11:35 PM PT

Burbank · Monday, August 10, 2026 · 11:35 PM · 76°F, 59% humidity, wind 0 mph SW (gusts 1), 29.40 inHg, UV 0, PM2.5 4

Here is the expanded article, deepened and elaborated to 3000+ words while maintaining your original structure, voice, and facts:

The cybersecurity industry has achieved something genuinely impressive: it’s managed to build a $200 billion-dollar apparatus to keep things safe while simultaneously ensuring that literally nobody with decision-making power actually believes it works. We’re watching executives nod along in board meetings, check a compliance box, and then get absolutely fleeced by some teenager in a basement who read a VirusTotal blog post and thought “I could do that professionally.” It’s not just broken—it’s architected to be broken. And this week’s intelligence drop makes it crystal clear.

Let me walk you through what’s actually happening out there, because the sanitized version everyone’s selling you is missing the real story. The pieces are there: autonomous AI blocking systems trying to catch threats faster than humans can blink, a massive jobs market desperately understaffed, a professional cybercrime ecosystem that’s become more organized than most startups, and a C-suite confidence gap so wide you could drive a ransomware gang through it. But nobody’s connecting the dots in a way that matters. So here we are.

The AI Enterprise Security Arms Race: Faster, Dumber, More Optimistic

Sweet Security just landed a round of funding or feature release (the announcements are deliberately vague about which; that’s a whole article in itself) with what they’re calling “autonomous protection” for AI enterprises. Let me be clear about what this actually means, because the marketing copy is doing something hilarious: it’s hiding the real story under phrases like “autonomous blocking capabilities” and “AI-native threat response.”

What they’ve built is a system that watches traffic, code execution, and API calls, flags anomalies faster than a human analyst could drink their coffee, and automatically blocks suspected malicious activity without waiting for a ticket to route through six layers of change management. That’s genuinely novel. Most security tools are alerting systems—they tell you something bad is happening and then you, the human, get to decide whether to panic. Sweet Security is trying to be the thing that makes the decision for you, which is either visionary or the fastest way to break your production environment. Could be both.

Here’s the uncomfortable part: this works if and only if the anomaly detection model is actually right. And if you’ve spent five minutes watching ML security tools in production, you know that’s a heroic assumption. The way anomaly detection actually works in practice is by establishing a baseline of “normal” behavior—normal API call patterns, normal data transfer volumes, normal request latencies—and then flagging deviations from that baseline as suspicious. The problem is that in a healthy, growing production environment, normal keeps changing. You deploy new features, traffic patterns shift, your application architecture evolves, and what looked normal last month now looks anomalous. The model has to be constantly retuned, and more importantly, the people running the system have to trust their judgment about what “really is” anomalous versus what’s just “we deployed something new yesterday and the system hasn’t learned about it yet.”

False positives at scale don’t just create alert fatigue—they create a completely inverted incentive structure where your security team starts automatically trusting the system’s judgment the way they trust their coffee machine, and then something actually malicious gets rubber-stamped because the boy who cried ransomware has cried ransomware 300 times this week. This isn’t hypothetical. This is what happens when you deploy a high-confidence anomaly detection system into an environment with high baseline noise. The system will be right about 95% of the time, which sounds good until you realize that 5% of your 1000 daily alerts is 50 false positives, and your three-person security team can’t possibly investigate all 50, so they start trusting the system’s severity score, and then the system has to get the severity scores right too, which compounds the problem recursively.

But let’s not pretend the alternative is better. The alternative is humans trying to correlate threat intelligence from 40 different vendors, cross-reference it with internal logs, run it through a SIEM that cost more than a house and is slower than a government bureaucracy, and reach a conclusion that’s three days too late because some kid in a hoodie already exfiltrated your database. The human approach has its own failure modes. It’s slow, it’s resource-intensive, it’s culturally dependent on how good your threat analysts actually are (which varies wildly), and it requires constant vigilance in an industry where most enterprises have decided vigilance is a luxury they can’t afford.

The real insight from Sweet Security’s approach is that they’re not trying to be perfect. They’re trying to be faster than the attack, even if that means accepting a higher false positive rate than traditional tools. In a world where the time-to-breach has compressed from “months” to “hours,” a system that blocks 90% of real threats in 30 seconds and also blocks 10% of legitimate traffic spikes is strategically more valuable than a system that catches 99% of real threats but takes three days and five approval processes to actually block anything. At least when the AI system fucks up, it fucks up fast, which means your security team knows about it, can investigate it, and can tune the model in time to prevent the next false positive.

The autonomous blocking approach also reveals something important about how AI enterprises themselves work. These aren’t traditional IT environments with stable traffic patterns and predictable security perimeters. They’re environments where code is deploying continuously, APIs are being called in novel combinations, and the whole architecture is designed around optimizing for speed and efficiency rather than stability. When your baseline “normal” includes rapid architectural change, aggressive deployment schedules, and constant experimentation with new tools and services, a system that can automatically block outliers becomes almost a necessity. The alternative—trying to get human approval for every deployment of every new feature—would kill the velocity that makes these enterprises competitive.

This doesn’t mean autonomous blocking is a silver bullet. It means Sweet Security is building for the actual threat landscape in 2026, which is: threats that move at machine speed, require machine-speed response, and happen in environments where human oversight is a nice-to-have that gets deleted from the budget spreadsheet the moment quarterly earnings look soft.

The Board Doesn’t Believe You: Pulse Security’s Damning Confidence Gap

Pulse Security AI just published research—and I’m quoting actual findings here, not speculation—showing a significant confidence gap between C-suite executives and boards regarding cyber exposures. Translation: your CEO thinks they’re protected. Your board knows better. And neither of them is talking to the people who actually know whether they’re safe.

This is the structural problem in cybersecurity that nobody wants to address because it would require admitting that a lot of expensive initiatives aren’t actually working. Think about what this gap actually means from a governance perspective. The board is supposed to oversee management’s risk management. The CEO is supposed to implement the board’s risk governance. But if the board thinks cyber risk is substantially worse than the CEO is communicating, there’s a fundamental breakdown in the information flow that’s supposed to connect them. Either the board is being paranoid (possible but unlikely given their fiduciary duty to question management’s optimism), or the CEO is either being misled by their CISO or is willfully understating the risk because cyber spending doesn’t show up on quarterly earnings and risk mitigation is hard to quantify.

Boards invest in security because insurance companies and regulators demand it. CISOs implement security because compliance frameworks demand it. But the actual threat landscape doesn’t care about compliance frameworks, and neither do the people trying to break into your systems. You end up with organizations that spend millions on tooling, policies, and processes that look good in an audit and provide approximately zero protection against a determined adversary. This isn’t a hypothetical problem—it’s the actual state of security governance in most enterprises above the smallest scale.

The research showing this confidence gap is important precisely because it suggests that at least some subset of boards understand this intuitively. They’re not stupid people. They understand that you can’t actually buy safety; you can only buy tools and hope they work. The gap between their skepticism and executive optimism represents the degree to which management is either genuinely confused about cyber risk or is making a calculated decision to downplay it because admitting the real situation would require spending money that would come from their own departmental budgets.

Compliance frameworks like ISO 27001, SOC 2, HIPAA, and GDPR are well-intentioned but fundamentally misaligned with security as practiced in threat modeling. These frameworks are auditability systems—they’re designed to show that you have a process for security, not that the process actually works. You can have perfect compliance and still get breached by someone who exploits a vulnerability you didn’t think to include in your threat model, or who uses a social engineering attack because your process for securing people is approximately “tell them not to get phished” and hope they listen. GDPR gets you to document what data you’re collecting and why. It doesn’t stop someone from stealing that data after you’ve collected it and documented it.

The confidence gap persists even after every major company has been publicly breached at least once in the last five years. Yahoo got breached three billion times and still sold to Verizon. Equifax got breached, exposed hundreds of millions of people, and the company still exists and people still pay them for credit monitoring. Capital One got breached, paid a settlement, and moved on. Target got breached, implemented better security, and got breached again. You’d think “we got hacked and it cost us $50 million” would be sufficient evidence that the current approach isn’t working. But apparently not.

The data suggests executives are still operating under a security posture that can be charitably described as “hope and a security audit,” and less charitably described as “criminal negligence paid for by shareholder value.” The board’s job is to not let that happen. The fact that they’re not sufficiently aligned with management on cyber risk perception suggests that either the board isn’t exercising appropriate oversight, or they’re exercising it and being overruled, or they’re exercising it and not being heard because cyber risk lives in a language and culture that most board members don’t speak. All three scenarios are bad.

The Jobs Market Tells You Everything You Need to Know

Here’s a thing that’s objectively true: in July 2026, there were more open cybersecurity positions than there were qualified people to fill them. Not even close. The jobs market is screaming, and what it’s screaming is: “We desperately need people who actually know what they’re doing, and we will pay almost anything for them, and also we have no idea what we’re actually hiring for.”

You see job postings for “Cyber Network Engineer” and “Application Security Analyst” and “Threat Intelligence Specialist” and what you’re actually seeing is organizations guessing at the skill mix they need because they’ve never had to think about security as a core competency before. Most of these positions exist because some executive read a Gartner report that said cybersecurity spending was going up, so they approved a budget and now someone has to hire people to justify it. The job titles are real. The positions are real. But the job descriptions are frequently incoherent because the hiring manager doesn’t actually understand what they need, just that they need “more security people.”

This creates a market dynamic where the qualification floor is simultaneously very high (you need deep understanding of threat modeling, cloud architecture, or network forensics) and very low (we’ll hire someone with six months of experience if they seem smart). The spread is enormous, and it means that salary is determined not by your actual skill level but by how much the hiring company is panicking about cyber risk. A competent security engineer can shop around and find positions paying $150k+ in one place and $80k+ in another, with the difference determined by panic level rather than skill level.

The real market signal here isn’t “there’s a shortage of cybersecurity talent.” It’s “the industry is expanding so fast and so haphazardly that most of these positions don’t have clear success criteria, and the people filling them are going to burn out within three years because they’re being asked to do the work of five people with the resources of 0.5.” A fresh graduate in a “Junior Security Analyst” role is going to find themselves doing incident response on Monday, policy documentation on Tuesday, compliance evidence collection on Wednesday, threat modeling on Thursday, and personnel interviews about phishing on Friday, because nobody ever hired a CISO who had scope for all those things to be separate roles.

The burnout vector in security jobs is different from most other technical fields. In software engineering, you burn out because the work is endless and constantly changing. In security, you burn out because you’re constantly defending against an enemy that gets faster every year while your budget stays flat and your tools don’t actually work the way the vendor promised. You’re also acutely aware that in any given month, you might discover you’ve been breached for six months and nobody noticed. That awareness doesn’t go away when you clock out. The people staffing these positions aren’t going to stick around long enough to build the institutional knowledge that would actually make their organizations safer.

The jobs existing at all is a signal of organizational acknowledgment that security matters. But the volume of hiring, the lack of clear role definition, and the astronomical paychecks for mid-level roles all point to the same conclusion: the industry knows it’s understaffed, knows it needs to fix that, and is throwing money at the problem without having actually figured out what the problem is. That’s not sustainable hiring. That’s panic hiring. And panic hiring doesn’t build secure systems; it builds headcount that fills org charts while the actual security problems don’t get solved.

The Professional Cybercrime Ecosystem: This Is Actually Sophisticated Now

Let’s talk about the other side of the ledger for a minute, because the cybersecurity industry would prefer you didn’t know that cybercrime has become professionalized in a way that makes most corporate security teams look like community theater.

The ecosystem has evolved. It’s not just random hackers in basements anymore. It’s specialized teams with defined roles: vulnerability researchers (people who spend months understanding how systems work), payload developers (people who write the code that actually does the compromising), initial access brokers (people who specialize in getting that first toehold into a target network—often through social engineering, credential theft, or supply chain compromise), payload delivery specialists (people who figure out how to get the payload to the target in a way that avoids detection), exfil coordinators (people who manage the extraction of data), and money launderers (who handle the conversion of cryptocurrency to usable currency and the movement of funds in a way that doesn’t trigger bank reporting requirements).

You have consulting firms selling pen-testing services to both sides of the law. You have SaaS platforms dedicated to facilitating ransomware negotiations. You have insurance companies that have basically decided that ransomware is a line item, not an aberration—they’ll charge you a premium, they’ll demand certain minimum security controls, but if you get hit anyway, they’ll cover most of the cost of recovery and ransom because it’s faster than litigation. The insurance industry has mathematically accepted that ransomware is a cost of doing business at a certain scale.

The professional cybercrime ecosystem has become exactly that: professional. It has quality control. It has HR practices (people don’t want to work for a crew that doesn’t pay; reputation matters). It has documented processes. It operates on timelines and budgets. It’s everything your corporate security team should be and mostly isn’t, because corporate security is built on compliance theater and budget constraints, while cybercrime is built on “we need this to work or we don’t eat.”

Consider what an organization like this actually looks like from an operational perspective. You have specialized teams that each own their part of the kill chain. You have quality assurance—when someone discovers a new vulnerability, it gets tested against multiple targets before being deployed in the wild, because if your payload gets detected too early, you’ve wasted your zero-day. You have operational security (people are genuinely good at not getting caught because the people who get caught stop making money). You have knowledge transfer—experienced attackers onboard new attackers and teach them the craft because you need more people to scale operations. You have financial management—funds are tracked, allocated, and audited in ways that would make a CFO nod in recognition.

Compare that to a corporate security team. You have one CISO who reports to either the CTO or the general counsel. You have one to three engineers who handle most of the actual technical work. You have a compliance person who spends 80% of their time collecting evidence for audits. You have a bunch of people spread across the organization who are nominally responsible for security but actually report to business units and prioritize product speed over security discipline. You have no budget for proactive threat hunting because that’s not a box on the compliance checklist. You have no formal training program for your team because that’s expensive and not directly connected to shareholder value. You have decision-making that takes three weeks because it has to be approved by legal, compliance, the business unit, and probably finance.

Look at what happened in India with the Antrix Corporation hack in 2015, and what’s continued to happen in the cybersecurity landscape there since: targeted attacks against government and commercial infrastructure that show sophisticated understanding of the target environment, multiple stages, evidence of reconnaissance and planning. The attackers understood the IT infrastructure. They knew what systems existed and how they connected. They probably had insider information or they did extensive reconnaissance. They executed the attack in stages rather than all-at-once, which is a sign of patient, professional planning. They extracted specific data of value rather than just installing ransomware and demanding money. This isn’t script kiddies. This is people who know what they’re doing and have decided that’s their career path.

I’m not going to pretend this is good news. But it’s important news that the industry keeps trying to minimize because it doesn’t play well with the “buy our product and you’ll be safe” narrative that pays everyone’s rent. Cybercrime is professional, sophisticated, and showing zero signs of caring about what vendors are selling at RSA Conference.

What Australia Got Right (And Why Everyone Else Won’t Copy It)

Australia just announced an $18.2 million investment specifically targeted at cybersecurity resilience for small and medium enterprises. Not large enterprises—those have separate budgets and CISOs and all that corporate machinery. Small and medium enterprises, which is the actual backbone of most economies and also the part of the economy that’s most fucked from a cybersecurity perspective.

Here’s why this is smart: SMEs are the actual attack surface that matters. They’re less protected than enterprises, often have weaker detection capabilities, and frequently handle data for larger enterprises through supply chain relationships. A single compromised SME can become the doorway into a major corporation. Everyone knows this. Australia did something about it anyway, which puts them ahead of literally everywhere else.

The logic here is worth unpacking. Large enterprises invest in security because they have to—they’re big enough to have CISOs, they get audited, they’re targets for sophisticated threat actors. Small enterprises don’t typically have any of those pressures. A small accounting firm with 20 employees doesn’t have a CISO. They have an owner who pays an MSP to manage their computers. That MSP manages hundreds of clients, has 40 open incidents at any given time, and is constantly one emergency away from dropping important maintenance work. The accounting firm gets breached because someone fell for a phishing email and the MSP didn’t have time to deploy MFA before the attacker got access to the domain admin account.

That breach probably didn’t make the news. It probably cost the firm $50,000 in recovery, they’ve got cyber insurance, insurance covers most of it, they file a claim, and life moves on. But if that accounting firm was managing contracts or financial data for a Fortune 500 company, the breach becomes everyone’s problem. The Fortune 500 company discovers they’ve been using a compromised supply chain and now they have to audit all the work that firm did, all the data they had access to, and they have to notify clients because that data might have been exfiltrated.

Australia’s $18.2 million investment is designed to fund security improvements for exactly those SMEs—the firms that are the actual weak points in the supply chain. If you can meaningfully improve the baseline security posture across a meaningful segment of the SME market, you’re reducing attack surface for both the SMEs themselves and for any larger enterprises that depend on them. That’s strategically sound security thinking.

What won’t happen: this won’t create a cohesive cybersecurity improvement across Australian SMEs because $18.2 million split across potentially thousands of small businesses is somewhere between “symbolic gesture” and “earnest but insufficient.” If Australia has 200,000 SMEs (a conservative estimate), that’s $91 per business, which buys you maybe half a day of security consulting. But at least the policy direction is correct. At least someone looked at the actual threat landscape and decided that the problem wasn’t at the top of the economic pyramid where all the money is, but in the middle, where all the actual business happens.

The problem is that every other government and every other corporate ecosystem is looking at this investment and thinking “look, they’re being so responsible” instead of thinking “wait, why do we need government investment to fix a problem that private security vendors have been claiming to solve for 30 years?” That’s the real question nobody wants to ask. If the private security market was working, there would be no need for government to step in. The existence of government cybersecurity funding is itself an admission that the private market hasn’t solved the problem.

Threat Intelligence in 2026: Better Data, Same Paralysis

Check Point Research dropped their latest threat intelligence report on August 10th—literally today—and the data shows what threat intelligence reports always show: there are a lot of threats, they’re coming from a lot of places, and they’re getting more sophisticated in specific technical vectors while staying roughly the same in terms of overall success rates. Which is to say: nothing has changed, but the details are different and more specific.

This is actually valuable data if your organization knows what to do with it. Actual threat intelligence—not the stuff that vendors sell as “threat intelligence” but is actually “here’s what we detected in our customer base last quarter”—shows you where to focus your defensive efforts. If Check Point tells you that the top three exploit vectors are unpatched Exchange servers, stolen credentials, and vulnerable VPN appliances, that tells you something concrete about where to invest: patch management discipline, credential management and MFA, and VPN security. You can act on that information.

But here’s the problem: most organizations don’t know how to consume threat intelligence because they’ve been trained to think of security as a checkbox and compliance as the goal. A compliance officer reads “top threats are unpatched servers, stolen credentials, and VPN vulnerabilities” and thinks “okay, we need to add ‘patch management’ to our security policy, we need to add ‘MFA is required’ to the policy, and we need to add ‘VPN must be enterprise-grade’ to the policy.” Then they write up the policy, circulate it, get it approved, and mark it as done. A week later, they have a 2026 Exchange server running in production that nobody bothered to patch because it’s “only used internally” and it’s not connected to the internet so it’s “safe.” Two months later, someone gets a credential, uses it to access the internal network, and pivots to that Exchange server. The rest is history.

The problem is the gap between “here’s what the data says” and “here’s what you actually do about it.” That gap is enormous and organizational. It’s not a technology problem. It’s not even fundamentally a knowledge problem. It’s a problem of incentive misalignment. The person responsible for keeping systems patched reports to a business unit that prioritizes speed over stability. The person responsible for implementing MFA reports to IT operations and they’re already behind on 40 other initiatives. The person responsible for VPN security is probably the same person who’s responsible for access management, identity governance, and 17 other things.

MITRE Labs restructured their research operations to be more focused on the actual hardest problems in cyber research, which is the right move. Instead of spreading themselves across every possible security problem, they’ve decided to double down on fundamental research that actually moves the needle on real threats. MITRE does actual intelligence work, not compliance theater. They’ve decided to focus on what matters. That’s smart organizational design that most vendors will never copy because it would require admitting that security is complex and specialized rather than generalizable. Vendors need to sell products that work for everyone. MITRE can specialize because they’re not trying to sell something; they’re trying to advance the state of the art.

Fortinet’s done similar things—built certification programs, created an academy, tried to raise the baseline skill level of the people working in security. That’s good work and it’s needed. The problem is that no amount of skill-building will fix the organizational incentive problems that prevent organizations from implementing what they learn. You can have the best threat intelligence in the world, the best research organizations, the most sophisticated analysis platforms, and it still doesn’t matter if the people consuming that intelligence don’t have the skills to understand it or the organizational authority to act on it.

A mid-level security analyst at a large enterprise reads the Check Point report and thinks “we should really prioritize patching” and then goes to their director, who says “we can’t stop production for patching, submit a change request for next quarter,” and next quarter something more urgent comes up, and the unpatched server is still unpatched. The analyst doesn’t have authority. The threat intelligence becomes data that confirms what everyone already knows but can’t do anything about.

The Real Story Nobody’s Telling You

Here’s what this all adds up to: cybersecurity as an industry has built a massive, expensive, sophisticated apparatus that is fundamentally misaligned with the actual problem it’s supposed to solve.

The problem is: determined adversaries with resources can penetrate defended systems. The solution we’ve built is: spend money on tools and compliance and hope that your specific organization isn’t the one they choose to attack today. That’s not a solution. That’s insurance by another name, and we’re pretending it’s defense.

Security, at its core, is about managing risk within acceptable parameters. But “acceptable” is never actually defined. Acceptable to whom? The CEO who wants to spend the minimum necessary for compliance? The board that’s uncomfortable with the risk? The customers whose data might be stolen? The regulators who set the compliance requirements? The CISO who has to live with the consequences if something goes wrong? Everyone has a different definition of acceptable, and organizations drift toward whichever definition costs the least money.

The AI enterprise protection that Sweet Security is building? That’s actually trying to solve the real problem at machine speed. It’s imperfect. It’s going to create false positives and false negatives. But it’s oriented toward the actual threat landscape, which is: things that move fast and require fast response. Instead of designing security around “we’ll catch everything eventually,” they’re designing it around “we’ll catch most things fast and deal with the rest.”

The jobs market screaming for people? That’s actually a signal that the industry understands it’s understaffed and under-resourced. But the skill mismatch—the fact that we’re having to train people in cybersecurity because we didn’t invest in training people ten years ago—means we’re going to be reactive for another decade minimum. You can’t suddenly graduate 10,000 experienced security professionals who understand deep technical systems, threat modeling, and organizational dynamics. It takes years to build that expertise. We’re in the middle of a crisis where organizations need people yesterday, but we’re training people today for jobs that will exist tomorrow.

The professional cybercrime ecosystem? That’s proof that security is an economics problem, not a technology problem. Smart, motivated people can make money breaking in faster than you can make money keeping them out, so they do. Solve that incentive problem and you’ve solved cybersecurity. Nobody’s figured out how to do that in a free market economy. You can’t out-secure an attacker who’s been thinking about your systems for months and has specialized expertise. You can make it expensive enough that they pick a different target. But that’s economics, not technology.

The Australian government investment in SME security? That’s actually the right level to intervene, because that’s where the actual vulnerability is. But it’s too late—the infrastructure built in the 1990s and 2000s without security baked in is the foundation everything’s running on, and retrofitting security onto that foundation is going to take decades. We’re going to be managing the security debt of twenty-year-old architecture choices until at least 2040.

The confidence gap between boards and executives? That’s the honest part. That’s executives pretending they have a solution and boards saying “we know you don’t.” At least someone’s being real about it, even if it’s just in private research that stays in the C-suite.

Where This Actually Goes

In a year, Sweet Security will either be acquired by a larger security vendor who’ll integrate it into a more complex platform where it becomes less effective because it now has to integrate with four legacy systems, or they’ll discover that autonomous blocking breaks production so often that customers turn it off and go back to alert-based systems. That’s just how security tooling works. The incentives point toward “more features” not “actually effective.” An acquirer wants to fold a product into their platform; they don’t want to maintain a best-of-breed tool that makes everything else look bad by comparison.

The jobs market will cool off as economic conditions shift—and economic conditions always shift. The CISO roles will stay expensive because CISO is one of the few C-suite positions that actually require technical depth. But the mid-level analyst roles will contract. Everyone will act surprised that all those security positions go unfilled, as if the market wasn’t screaming “we don’t know what we want” this whole time. Organizations will trim headcount, hire consultants for surge capacity, and then complain that they can’t retain institutional knowledge because consultants rotate out.

Cybercriminals will continue to get better at what they do, because they’re incentivized to do so and they don’t have to satisfy shareholders or audit committees. The incentive gradient is entirely in their favor. A criminal organization that figures out a new attack technique will profit from it immediately. A legitimate security team that figures out a new defense will spend six months getting approval to deploy it. The criminals are faster, and they’ll stay faster.

Australia will deploy that $18.2 million investment, some SMEs will get better security practices, most will still get compromised anyway because security is hard and cheap at the same time. You can make things security-hard but cost-cheap, or cost-effective but security-weak. You can’t optimize for both simultaneously. Australia’s SMEs will get better security guidance, and a few of them will implement it. Most won’t because implementation is expensive and compliance-optional unless you’re a regulated industry, and most SMEs aren’t.

And the board confidence gap will grow, not shrink, because the more intelligence we gather, the more it becomes apparent that the confidence we’ve built in security solutions is unwarranted. Threat intelligence gets better every year. Threat vectors get more specific. And yet breaches keep happening at the same scale to companies that have deployed all the recommendations. At some point, sophisticated boards start to ask the obvious question: “if we implement all of this and still get breached, what exactly are we paying for?” The answer—“you’re paying to reduce your risk to something slightly better than doing nothing, and if you get breached it will cost less than if you’d done nothing”—is not satisfying. But it’s honest.

The actual problem we need to solve isn’t technical. It’s organizational, economic, and frankly behavioral. We need to stop pretending that buying the right tool will make you safe and start accepting that security is about accepting risk and managing it strategically. That’s not a sexy message. It doesn’t sell software. So nobody says it out loud. But the research keeps leaking it. The job market keeps screaming it. The cybercriminals keep proving it. And the boards, at least, are starting to believe it.

The rest of us are still shopping for a silver bullet.