Cybersecurity First Principles: A Reboot of Strategy and Tactics

You're probably swimming in information every day trying to say well informed, especially when it comes to something is well complex and critical as cybersecurity.

Oh, definitely, so many buzzwords, best practices, just so much noise.

Exactly, But what's really at the core of it all? Today we're trying to cut through that noise, give you a shortcut maybe to understanding cybersecurity at its most fundamental level.

Yeah, we're going on a bit of a deep dive into a powerful new approach, and.

To help us navigate this, we've been digging into a really fascinating new book, Cybersecurity First Principles, a reboot of strategy and tactics by Rick Howard and Steve Winterfield.

And guiding us today. We have someone with a real natural curiosity, a knack for making these, let's face it, sometimes dense topics genuinely interesting.

And our expert here is brilliant and synthesizing all this info and helping us understand why it actually matters. This deep dive. It comes from two real industry veterans, Rick Howard and Steve Winterfie.

Yeah, Rick's the chief analyst at the Cyber Wire Stee's Advisory CISO at Akamai. These guys have decades of experience.

They've literally written the book on this step, and.

They joke they wrote it to satisfy mobs of learners, which is kind of fun, huh.

Right, And they pose this big question, don't they. If you ask, say, one hundred cybersecurity pros what they're trying to achieve, they'.

Get a hundred different answers. Easy, everyone's got their own focus.

But what if Yeah, what if there was one core purpose, one atomic first principle for all of cybersecurity?

Okay, yeah, let's unpack that. They lay out this foundational belief, this principle reducing the probability of material impact due to a cyber event over a finite set of time.

Reducing the probability of material impact. Okay, So this idea of a first principle, it's not just like a Twitter meme.

No, No, definitely not. It goes way back. I think Aristotle, Descartes, Elon Mussa talks about it a lot now too. It means breaking a really complex problem down to its it's primary essence. These fundamental, self evident truths, the basic building blocks, you know.

Okay, atomic building block. So if that's the standard. Why don't a lot of the usual suspects, the common best practices make the cut.

That's a great question, and the book really gets into it. They look back even to the seventies and eighties. What was the thinking then, Well, researchers back then they actually thought the ultimate goal the first principle was to build a completely secure computer, like perfectly secure.

The dream, the dream.

But yeah, it was largely abandoned, just seen as impractical. People still kind of lament that failure.

Okay, so that didn't work out. What about the CIA triad confidentiality, integrity availability? Everyone knows that one.

Everyone knows it. It's foundational thinking, absolutely, But the authors argue it's more like general best practice.

Not the atomic principle.

Right, it doesn't fully capture the ultimate purpose of an entire security program. Some even say it's frankly in adequate for today's threats.

Okay, how about patching. I mean we hear it constantly keep your systems updated sounds pretty fundamental.

It's critical, no doubt. Systematically upgrading is vital. But and this is interesting, the data shows hackers use actual code exploits in like less than ten percent of known breaches.

Less than ten percent. Wow.

Yeah, so the authors point out, even with decades of focusing on patching, it hasn't really abated the volume of successful cyber breaches. Important tactic, Yes, the foundational principle, they argue.

No, okay, so patching is out as the core principle. What about other things people aim for, like stopping malware or instant response or following frameworks like NIST or you know, compliance stuff like GDPR.

Yeah, good examples. The book argues these are often either too simple, like just stopping one type of threat, or they're too tactical. Tactical meaning meaning they're specific actions, but they don't answer the big why why are we doing all this? They don't define the overall purpose, and often they're kind of black and white. You know, did you do it or not? Right?

Check the box exactly?

Compliance? For instance, it might be necessary for business a ticket to ride or for brand reputation. But does ticking those boxes inherently reduce the chance of a material impact? Not necessarily?

Okay, So that brings us back to that word material. What's missing from all those other approaches that this new atomic principle gives us.

It's that focus on materiality. That's the absolute key insight. I think.

Explain that a bit more.

Well, think about it. Not everything on your network is equally important, Right If some hacker gets Luigi's lunch menu off his laptop, Yeah, probably not calling the FBI exactly. So why spend potentially infinite resources trying to protect absolutely everything equally, especially when resources are always finite?

Ah? Okay, So the atomic principle forces that focus. It's reducing the probability of material.

Impact to a cyber event over a finite set of time. Precisely, it forces you to identify what truly fundamentally matters to the business mission.

And that's going to be different for every company.

Right absolutely depends on their risk tolerance, their size, industry, you name it, and it changes over time too. Business leaders know what's material. The job of security pros is to understand that deeply and align the security effort accordingly.

Okay, this makes a lot of sense. So let's dive into the strategies that actually flow from this core principle. The book lays out five right, starting with zero trust.

Yep, zero trust, the never trust, always verify mindset.

Before this, say, pre twenty ten, what was the main.

Approach mostly perimeter defense, build big, strong electronic fences around your stuff, castle and mote thinking. But the problem was the problem was the chewy center. If a bad guy did get inside that perimeter.

They could roam around pretty freely.

Often. Yeah, access to way too much.

And the Edward Snowden case in twenty thirteen really drove this home.

Didn't there a classic textbook example. He was an IT admin, had legitimate credentials, He didn't hack his way in. He basically web served on a classified network using a crawler he bought, grabbed over a million documents, and walked out because.

He was already inside the castle walls exactly.

It showed the fundamental weakness of just relying on the perimeter.

So that kind of thinking led to John Kindervag's white paper in twenty ten, No More Shoey Setters.

That paper was huge. It really proposed the zero trust model and started changing how people thought about network security.

So zero trust isn't just like buying a specific product. It's a whole strategy, a mindset.

It's definitely a strategy of philosophy. Restrict access to everything based on need to know and continuously verify don't assume trust just because someone is inside the network.

Okay, so how do you actually do zero trust? What are some key tactics?

Well, one big one is vulnerability management, but it's more nuanced than just patch everything.

Right, you mentioned patching earlier. Wasn't the whole story exactly?

So NIST cattle over eighteen thousand new vulnerabilities in twenty twenty one. That's overwhelming.

Yeah, how do you even start?

But here's the crucial part. SISA, the US Cybersecurity Agency, found that only about eight hundred and twelve of those were actually being actively exploited by attackers in the wild.

Only eight hundred and twelve out of eighteen thousand. That's manageable.

Right, So, vulnerability management under zero trust means focusing intensely on those known exploited vulnerabilities. First, Patching becomes a targeted subset of this smarter approach.

That's a really practical takeaway focus where the actual risk is. What else is key for zero trust?

Identity knowing who is accessing what. So identity and authentication is huge.

We've moved beyond just passwords thankfully.

Oh yeah, passwords from the sixties were obviously weak. We moved to things like hardware tokens in the eighties than two factor authentications something you have are or no got patented in the nineties, and.

Smartphones really made that mainstream, right, authenticator apps, push notifications.

Totally, and things like U two F security keys. Now the big goal here is shifting from site centric identity, where every website holds your password, to user centric.

Identity, where I control my identity credentials.

Exactly makes it much harder for one breach to compromise everything.

And the Solar Winds attack in twenty twenty is a scary example of why identity systems themselves are critical.

Absolutely terrifying. The Cozy Bear hackers got admin rights compromise this SAM authentication system.

SAML being this system that lets you log in once for multiple services.

Right, and they could then forge tokens to impersonate any user, even the highest privileged admins. It shows your identity and access management. Your IAM system is itself a material system. You have to protect it fiercely. Single sign on SSO is a key tactic, but securing the SSO system is paramount, okay.

Another tactic mentioned is the software defined perimeter or FDP. Sounds kind of techy.

It is a bit, but the concept is powerful. It came out of US military thinking in the early two thousands. They called it deeperization, getting rid of the perimeter. Essentially, Yeah, instead of connecting to the whole network, you first authenticate to a separate controller outside the firewall.

Okay, if you're.

Authorized for say one specific application, the controller creates a secure, encrypted tunnel only to that one application. Everything else on the network stays hidden, like it's in a black cloud.

Ah, So it drastically shrinks the attack surface. You can only see what you're explicitly allowed to see.

Precisely, Google did something similar with their Beyond COREP initiative after a big Chinese hack in twenty ten. The name STP is actually kind of ironic because it's about eliminating the traditional perimeter, not defining it.

So zero trust sounds like the way to go. Why do these projects sometimes fail or stall out?

Well, they can look really big and expensive upfront, that's true, but the authors argue it's often less about the tech and more about people and process problems getting buy in changing habits. It's really a journey continuous improvement, not a one and done project. You can often start with the tools you already have.

That's encouraging. Yeah, okay, let's shift to the second big strategy, intrusion kill chain prevention, breaking the attackers steps right.

This was another huge paradigm shift around twenty ten, thanks to a paper from Lockheed Martin. What was the shift before that? Defenders were mostly focused on blocking individual tools, specific malware, specific exploits. Whack them mold, Yeah, it feels impossible. The Locky paper flipped it. It said, Look, attackers have to succeed at a series of actions to reach their goal recon weaponization, delivery, exploitation installations. See two actions on objectives.

The kill chain.

The kill chain, You the defender, only need to break one link in that chain to stop the entire attack. Much more strategic, and this.

Is super relevant in what some call continuous low level cyber conflict right like nation.

State stuff exactly David Sanger's term. It describes how countries use cyber operations just short of war. Think Stuck's net targeting around on centrifuges or Russia's not Petya attack devastating Ukrainian systems.

Destructive but not triggering a shooting war.

Precisely, it's a calculated level of conflict, and defending against it requires understanding and disrupting that multi step process.

So what are the key tactics for breaking the kill chain?

Intelligence is paramount? The book talks about the adversary model trifecta.

Okay, sounds important. What's in the trifecta?

First, the Lockheed Martin kilchain itself. That's the high level strategic map of an attack.

Okay, the overall phases.

Second, and this is where it gets really practical for defenders, is the Miter EATT and CK framework.

Ayah ATT and CK. You hear that everywhere.

Now and for good reason. Launched in twenty thirteen, it catalogs the specific techniques and tactics used by known threat groups the apts. But the most important thing MITER did was create a standardized vocabulary.

Why was that so crucial?

Before miter AT and CK everyone described attacks differently. Sharing intelligence was a nightmare, just pure grunt work trying to translate. MITER gave everyone a common language. Huge step forward.

Okay, kill chain, mi ATP and c K. What's the third part of the trifecta?

The DoD diamond model developed around twenty eleven. It helps analysts map the relationships between four key aspects of an attack, the adversary, their capabilities, the infrastructure they use, and the victim. It helps connect the dots.

Connecting the dots. You had a story about that with the French police.

Ah. Yeah, I was meeting with the Gendarmeris cybercrime unit captain. He was frustrated, saying, I don't need lectures on firewalls. I need actionable intelligence IP addresses. I can block domains, I can take down What what did you do? I texted my intel director basically saying, need French ctwips now. Within minutes, I got back a list. I showed it to the captain. His eyes lit up and he immediately got on the phone to start shutting those nodes down. That's actionable intelligence.

Wow. Okay, So that perfectly leads into the next tactic, cyber threat intelligence or at CTI.

Right, and CTI isn't just read security news headlines. It's a formal process, hope. It's about systematically collecting, processing, analyzing information about adversaries, their capabilities, intentions, and then producing intelligence products that help leadership make actual decisions. It follows a cycle planning, What do we need to know? Collection, processing, analysis, and production, dissemination feedback.

So it's not just here's the latest vulnerability exactly.

We learned that early on. Commanders tune out if you just give them news. They need intelligence tailored to the decisions they have to make.

And since no single company can see everything, intelligence sharing becomes.

Vital, absolutely critical. The Morris worm back in nineteen eighty eight was a wake up call that led to things like ISx information sharing and analysis centers like the FSIS for the financial.

Sector, how do they manage sharing sensitive info safely?

A key innovation was the Traffic Light Protocol TOLP, develop in the UK. It uses simple color codes red, amber, green, white to label how widely information can be shared, builds trust and.

The future vision is even more automated sharing.

Yeah, ideally an API driven database, maybe government provided, covering all sorts of adversaries, not just nation states. We're not there yet, but that's the direction.

Speaking of adversaries, we hear all these cool, sometimes scary names, cozy bear, fancy bear, lazarrisk group. How much weight should we put on attributing attacks to these specific groups?

That's a really good question. And there's nuance. When security companies talk about Cozy Bear did this, they usually mean a tax sequence attribution. They've identified a pattern of tactics, techniques, and procedures a playbook that matches what that group usually does.

So it's matching the how, not necessarily knowing the who behind the keyboard exactly.

Pinpointing the actual humans involved. Hacker identity attribution is incredibly hard. Spy agencies can sometimes do it, but they rarely share that publicly. For most defenders, obsessing over the specific group name is less important than understanding their playbook and how to counter it.

Okay, that makes sense. Focus on the meta. Now, with kill chain, mitre at T, and ck CTI, it sounds like a lot of different tools and data feeds. How do you manage all that?

Orchestration becomes key. It's just not feasible manually anymore. Back in the late nineties, maybe you had three security tools. By twenty twenty two the average was seventy six.

Seventy six.

Wow, Yeah, so you need tools to manage the tools, things like the big all in one platforms from firewall vendors or sr tool Security orchestration, Automation and response. They help automate workflows, connect different systems.

And newer concepts like SASSE or SSE fit in here too.

Right, Secure Access Service Edge or Security Service Edge. They kind of flip the model routing traffic through a cloud provider security stack. It's all about finding ways to manage that complexity and make the different parts work together effectively. Mastering orchestration is vital and.

One more tactic for the kill chain strategy red Blue and Purple teaming.

Yeah, this is about testing your defenses proactively. The Red team acts like the adversary, trying to break.

In the attackers.

The Blue team defends using all those tools and intelligence we just talked about, and Purple team brings them together, fostering collaboration and feedback loops, so the Blue team learns directly from what the Red team finds, and vice versa. It's incredibly valuable for continuous improvement and for training your analysts. Gives them real hands on experience.

Okay, excellent, Let's move to the third strategy, Resilience. This one feels different. It's not about preventing the breach exactly.

Resilience starts with the assumption that breaches will happen eventually, So the question becomes, what do we need to do to continue our mission after the fact.

So it's about bouncing back.

Bouncing back, yes, But even more it's about continuous delivery. The book uses a great definition, the ability to continuously deliver the intended outcome despite adverse cyber events.

Continuously deliver. Yeah, like the Terminator.

Hah Yeah, the T one thousand and T two is a pretty good analogy. He wasn't just built to survive damage. He adapted, reformed, kept coming, always focused on the mission. That's resilience.

Are there real world examples of companies doing this?

Oh?

Yeah.

Netflix is famous for its chaos engineering chaos Monkey, that's the one. After some big outages years ago, they built tools, starting with chaos Monkey in twenty eleven, that intentionally and randomly disable parts of their production.

System on purpose. That sounds terrifying.

It forces their engineers to build systems that can withstand failure to bick resilience in from the start. They have a whole Simian army of tools that inject latency kill processes.

Wow, okay, who else?

Google Site Reliability Engineering SRI is another classic example. Back in two thousand and four, they basically gave network management to software developers as the traditional ITOps right, and these sres focused on automating everything, eliminating manual tasks what they call toil, and building self healing autonomous systems. You almost never see a major Google service go down right, very rarely, but internally the esries will tell you stuff is failing

So how does this relate to, say, disaster recovery or business continuity plans? Are they the same thing?

They're related but distinct. Business continuity is usually broader, covering things like fires, floods, pandemics, force measure events. Disaster recovery is typically focused on recovering IT systems after a major.

Outage, and resilience.

Resilience is maybe a blend, but with that specific focus on continuously delivering the intended outcome. The author's stress getting the names right is important because confusion here has led to problems in the past.

Okay, so what are the key tactics to build resilience. Crisis handling seems.

Like a big one definitely, and practices everything. One of the authors shares a really painful personal story about his backup plan.

Oh what happened?

He thought he had this great system backing up all his precious family photos and digital days data. He configured it, checked it regularly. It always said a okay, sounds good so far, until his hard drive died. He went to restore and found out he'd accidentally configured the backup to copy an empty directory every day.

Oh no, all gone.

The lesson he learned the hard way. If a plan is not exercised, it is almost guaranteed to fail. You have to really test it ouch.

That's a visceral lesson. How does resilient apply to something like ransomware? Backups are key there right, absolutely central.

Ransomware has gotten so nasty, moving from hitting individuals to demanding millions from corporations, and just encrypting your data isn't enough protection anymore. Why not, because some ransomware will happily encrypt you're already encrypted backups, or just steal your data first and threaten to leak it. So the only real defense against the threat of having your data rendered unusable or exposed is a rock solid, tested backup and restore process for your material.

Data again, focusing on the material stock.

It makes the problem manageable. You don't necessarily need to back up everything instantly, just the stuff that's truly critical to delivering that intended outcome.

Okay. Encryption itself is another tactic listed under resilience.

Yes, though it's more of a passive tactic. You apply it beforehand to protect data at rest on discs or in motion over networks.

Ancient history right, codes and cipher's.

Goes way back. Spartans, romans, big leaps came with mechanical devices like the Enigma machine and then modern asymmetric crypto in the seventies Diffie Hellman RSA that allowed secure communication without pre sharing a secret key.

But managing all those encryption key seems like a huge challenge.

Now, it's incredibly complex, intricate, naughty, and labyrinthine, as the book puts it. You have keys for data centers, cloud mobile apps, and attackers know this. The Solarman's hackers remember, they compromise the authorization system to generate their own valid keys. So key management is critical.

Okay, So encryption is passive protection. What about when an attack is actively happening? That's incident response.

Right, exactly. IR is about dealing with the boom. It really started as a field back in eighty six with Clifford Stole tracking down those Russian hackers.

The cuckoos egg.

That's the one. A key part of IR is distinguishing a minor cyber event, maybe one miteror technique spotted from a major cyber incident, maybe a whole attack or playbook unfolded.

And when it becomes an incident.

Then it escalates beyond just the security operations center the SoC It triggers the wider organizational crisis plan involving legal, comms leadership. IR is a vital tactic, absolutely, but again the authors argue it's not the overarching first principle strategy itself.

And how an organization communicates during a crisis is make or break. The book contrasts RSA Security and Equifax.

Yeah, two starkly different examples. RSA and twenty eleven after their secured seeds were stolen a really bad breach, but their CEO took charge, communicated transparently, set a clear recovery plan, Project Apollo customers mostly stuck by them.

And Equifax in twenty seventeen.

A masterclass in what not to do confusing messages, blaming individuals, offering free monitoring that required victims to waive legal rights, just a mess.

They lost one point four billion dollars, but they survived.

They did, but largely because of they're victims. The consumers weren't. Actually they're paying customers. We didn't have a choice, a different dynamic.

So the big lessons seemed to be practice, practice, practice, not just the technical stuff. But the leadership responds.

To absolutely exercise. The leadership team run tabletop scenarios, focus on the desired outcomes, not just rigidly following a plan that might not fit the real situation. Even informal lunch and learns can.

Help and build relationships before you need them.

Crucial Invite the local FBI field office. Invite your auditors. Get to know them. When things are calm, It makes a world of difference when a real crisis hits.

Okay. Strategy four risk forecasting quantifying uncertainty. This sounds hard.

It is hard. Network defenders often struggle with calculating cyber risk precisely. But the key insight here is you don't necessarily need perfect precision. You need good enough answers to make good decisions like the.

Super forecasting research from Philip Tetlock exactly.

Tetlock found most experts are terrible forecasters unless they actually keep score and track their predictions. Leaders often fail by demanding certainty when reality is always probabilistic.

Like trying to be one hundred percent sure about bin Laden's location.

Right, It's never one hundred percent. And you also have Nassim Talib's black Swan idea. Those completely unpredictable high impact events. You can't predict them, so his advice is focus on resilience to survive them.

So if we can't predict perfectly, how do we get good enough forecasts? What are the tactics?

One is using Fermi estimates quick back of the envelope calculations.

In Rico Fermi the physicists Yeah.

One of the authors tells a story where his CEO, Peter Kilpee, use a quick Fermi estimate to decide against doing a much longer, more expensive risk analysis. This because the rough answer was good enough to make the decision.

So sometimes faster and rougher is better if it leads to the same action. Interesting, what else Bayes' rule? This is a different way of thinking about probability updating your beliefs as new evidence comes.

In developed way back in the seventeen hundreds.

Yep, by Thomas Bays. It was kind of controversial for a long time, but it's incredibly powerful. We don't have a ton of historical data like trying to forecast a novel cyber attack.

And the really cool part is Alan turn used it. Mind blowing right. Turing apparently used Bayesian methods measuring the weight of evidence updating probabilities to help crack the German Enigma codes during World War Two. Some historians think it shortened the war by years getting a good enough answer to break the code.

Wow, Okay, can we walk through a practical example. How would you estimate the risk for a typical company?

Sure, you can start with an outside view. Look at broad data like the FBI's IC three reports on cybercrime losses in twenty twenty one, you could estimate maybe two million material cyber events happened across the US. Okay, they're about six point three million organizations in the US, so very roughly, your initial prior belief might be that any given organization had around a thirty two percent chance facing a material.

Attack that year that high thirty two percent.

That's the rough starting point based on that data set. But then you refine it. That's the inside out analysis.

How do you refine it?

You use more specific data. Research from places like the Cyante Institute shows risk varies hugely by company size. A giant fortune two to fifty company might have a one to two chance of a material breach in a year fifty percent, but a smaller company, say under one billion dollars in revenue, might have less than a two to one hundred chance. So you adjust your thirty two percent prior based on factors like size, industry, et cetera.

And then you look at the company's own defenses exactly.

That's the crucial inside out part. How strong is their zero trust posture, how good are they at intrusion kill chain prevention, how resilient are they? You use your assessment of those things to adjust the probability estimate up or down. You can even test your confidence by asking would I bet one hundred dollars on this probability.

So for a hypothetical company, let's call it Contoso Corporation, big global manufacture, Okay.

Thirty five billion dollar revenue, you'd start maybe with the thirty two percent IC three prior adjust down based on Scientia data for their size, maybe to twenty two percent. Then you'd assess their actual security posture. Are they good at zero trust? Do they use threat intel? Well? Do they practice crisis response? Based on that, you adjust the twenty two percent figure to get your final tailored risk forecast.

It's a very different way of thinking than just red, yellow, green heat maps.

Totally different. It requires letting go of that need for perfect counts and embracing probability. But if Turing could use it to crack Enigma, maybe we can use it for cybersecurity risk. Those qualitative heat maps haven't really worked for twenty years, have they time for a change?

Agreed? Okay? Last strategy Automation the lynch pin of the future.

Yeah, this ties everything together. Just look at how software development itself has evolved from the old waterfall model.

Plan everything upfront, build it, test it at the.

End, right slow rigid, then came Agile in the two thousands, much more iterative, and then DevOps in the twenty tens, breaking down walls between development and operations, focusing on speed and automation.

And security got bolted on later.

Initially Yeah, but then came pushes like Microsoft's Trustworthy Computing after all those worms in the early two thousands, and eventually devsekops integrating security in every stage of that fast moving DevOps pipeline, using infrastructure's code, automating security checks, etc.

So the development world has really embraced automation for speed and reliability hugely.

Companies like Google and Amazon basically pioneered it with their SRI approaches. But the argument in the book is that the security community has been slower to apply that same level of automation to its own core functions deploying and managing zero trust kilchain defenses, resilience measures.

So automatetion isn't just a tactic within the other strategies.

It's presented as a fundamental strategy itself. You need automation to effectively deploy, manage, and maintain the entire first principles security architecture at scale.

What are the key tactics here? Compliance comes up again as an odd duck.

Yeah, it really is. Compliance is just conforming to rules, laws like GDPR, standards like PCIDSS frameworks like NIST. It generates a huge industry lots of checklists.

But compliant yet breached is a common headline.

Exactly, It doesn't inherently reduce the probability of material impact. Sometimes the cost of achieving perfect compliance far outweighs the actual risk reduction or the potential fine. It's often more about that ticket to ride or brand protection.

So it's a calculation to trade off.

It has to be is the cost of compliance worth it compared to other investments that might more directly reduce material risk.

And chaos engineering pops up again here under.

Automation right, because tools like Netflix's Simian Army are all about automated testing of resilience, intentionally injecting failures automatically.

And this fights against security theater.

That's the idea. Security theater is work that looks like security, makes people feel safer, but doesn't actually add much real protection. Some types of generic anti phishing training might fall into this category. Chaos engineering, by contrast, forces a real adaptive response. It encourages treating security testing like a science experiment, form a hypothesis about a weakness test. It automatically find the real flaws fix them.

Okay, so let's try and wrap this all up. We've taken quite the deep dive here.

We definitely have.

The core idea. The atomic first principle is reducing the probability of material impact due to a cyber event over a finite set of time.

That's the anchor, and flowing from that are the five key strategies we discussed, zero.

Trust, intrusion, killed chain prevention, resilient risk forecasting.

And automation, each with its own set of crucial tactics.

And this isn't just for the super technical folks, is it. It's about making better decisions overall.

Absolutely, it's about allocating those finite resources effectively. It's about communicating the value of cybersecurity to business leaders in terms they understand business impact risk reduction.

So final thought for everyone listening, think about your own organization. What does material impact really mean for your business? Is that where your cybersecurity effort is truly focused?

Or are you mostly checking compliance boxes or just fighting the fire of the day chasing individual threats without that strategic focus on what matters most?

Is it maybe time for your cybersecurity strategy to get a first principle's reboot.

Hopefully this deep dive has sparked some questions. Keep exploring keep questioning that status quo.

Keep learning. Thanks for joining us on this deep dive