Cyber has a really odd relationship with prevention. We like to talk about how important it is, but when you look at what we’ve historically been investing in, you see that we spend much more time and money on detecting, investigating, and responding to breaches than we do on preventing them. We buy better alarms, faster fire trucks, and fancier fire hoses, all the while the boring work of installing sprinklers, replacing the wiring, and enforcing building codes gets forgotten.
Several years ago, I was having a really great intellectual debate with my friend Abhishek Agrawal of Material. It was he who brought up these analogies about firefighters and building inspectors, and I found them absolutely brilliant. In this piece, I’ll expand on the idea and explain a massive shift that’s happening in cyber. All the credit for the concept goes to Abhishek.
This issue is brought to you by... Harmonic.
This founder wants to show you how your employees actually use AI
Your inbox is full of AI security pitches that sound identical. Alastair Paterson, founder of Harmonic, is more curious about something else: how your employees actually use AI. Which tools, which use cases, and how to control it in real time. Are AI investments paying off, and what is the risk?
Alastair just raised $50M to build more of it. (He also doesn’t know the marketing team took some of that cash to run this ad.)
Request a personal tour, tell us where you heard about us, and we’ll review your request for time with Alastair himself!
Cybersecurity has always been a market for firefighters, not building inspectors
Imagine if the city you live in would spend all the money allocated towards fire safety to buy more trucks, hire and train more firefighters, and give them the best tools to put out fires. Every time a new building burned down, the city would go and buy another 2-3 trucks. Eventually someone would start to wonder - is there anything else we could be doing to prevent the fires from starting to begin with? It’s inevitable that someone would do a study and say, “Let’s make sprinklers mandatory, let’s make sure every building has an emergency exit that’s kept clear at all times, let’s inspect and replace faulty wiring, and let’s make sure that when the electrical system gets overloaded, there is some kind of a mechanism to shut it down so that it doesn’t start the fire,” and so on. To be fair, you don’t have to imagine that because that’s exactly what we do.
The same isn’t the case in cyber. Look at where we spend the majority of our energy, time, and money. Most of it is about detection and response - EDR, NDR, XDR, ITDR, SIEM, incident response, and obviously now AI SOC. These are obviously all very important, but at some point somebody has to ask: what can we do to prevent these incidents from happening? Is there anything at all?
What actually moves the needle and makes companies more resilient looks as boring as building inspections. Removing application access that’s not being used, fixing configuration drift, patching systems, simplifying architecture, implementing secure defaults, and all the other work that doesn’t really make for a great BSides talk.
Think for a second what happens after a cyber breach, and the kinds of questions people are asking. You’ll see security teams ask why didn’t the tools fire an alert, how did the SOC miss it in the pile, and how this technique can be prevented next time. All very fair questions to ask, but imagine for a second if the fire investigation was focused on figuring out how to make the alarm louder next time instead of also thinking about what caused the fire and how it could have been prevented.
Why things are the way they are and why the firefighter approach won
Like it or not, there are good reasons why we are where we are.
First and foremost, firefighting is something everyone can see and hear, while prevention is mostly invisible. Think about all these bright and loud trucks on the road, and ask yourself when was the last time you saw a building inspector, or appreciated the work of whoever installed sprinklers. When a breach happens, security teams get a bigger budget, but if there are no breaches for a few years, it’s hard to ask for more money (in fact, that’s when companies start wondering why they are “spending so much on cyber”).
Second, it’s much easier to measure detection and response than it is to measure prevention. When a company is looking at two vendors, one of which is promising to make them more resilient so that the future attack doesn’t take the company down, and another that shows twenty suspicious alerts, it’s pretty obvious which of the two will be easier to measure.
Third, the organizational design solidifies this approach. A large part of our industry is built around SOC teams whose job is to look at alerts, triage them, investigate, prioritize, and so on. If you ask a firefighter what they need to eliminate fires, the firefighter is going to order better trucks and taller ladders, and not wire inspection.
Fourth, there’s the culture we as an industry have created. When you go to a security conference, talks about the latest exploits and how someone broke into a system attracts more people than talks about cleaning up identity sprawl or eliminating classes of issues with building tools for developers. Third, it’s much easier to celebrate a hero who solved the day by responding to an alert than it is to celebrate someone who patched a legacy system and then… nothing happened (I wrote about the hero culture years ago with Kym Price).
I can keep going on with this list for a while, but I’ll stop after calling out one more reason - and that’s the fact that prevention is legitimately harder to deploy. Similar to how it’s easier to install alarms than it is to install sprinklers or replace wiring, it’s also easier to buy some detection & response tool for the security team vs., say, change how the company does patching.
Why building inspectors in cyber haven’t solved the problem
In case you’re wondering, we do have an equivalent of the inspection industry in cyber - and that is what we call GRC, governance, risk, and compliance. There are plenty of standards that tell companies to encrypt data, document controls, establish patching processes, and so on.
Having regulations isn’t enough, though - one needs to design the right incentives (or enforcement) so that companies care about them. A real estate developer doesn’t spend money on sprinklers because it wants to make sure people will be safe, it does it because without them, the building will fail the inspection. There have to be incentives (think - impact on money) for people to care. In cyber, this has happened in regulated industries, but less so in non-regulated industries.
Overall, when it comes to security, our building inspectors have two big limitations.
First comes down to the speed of changes. Building codes and wiring standards can stay relevant for a long time because technologies around electricity don’t change that often, and we’ve had a very long time to come up with standards. In cyber, everything changes so fast that what was relevant yesterday may be completely irrelevant today (especially now with AI).
Second, inspections only tell you that something was true at a certain point in time. While buildings are static, our applications, users, access, patches, and everything else change very often. A cloud workload can expose a service next week even if it’s not doing it now, so point-in-time assessments aren’t really useful.
This is what I think creates this tension between engineers and GRC people. Security engineers often dismiss compliance as a useless checkbox, when it’s actually much more nuanced than that. Imagine firefighters mocking inspectors who ask that buildings have fire exits. The issue isn’t that inspectors are useless, it’s that the environments change so fast that inspections alone are just not enough for real security.
AI is changing this decades-old reality
It’s becoming pretty obvious that AI is changing this decades-old reality, and that these changes have much more to do with economics than they do with philosophy.
AI has completely changed the game for attackers who can now automate much of the work around reconnaissance, vuln research, and attack preparation. Breaking the company’s defenses is becoming as simple as pointing a swarm of agents at potential victims. As this happens, it’s becoming obvious that adding more analysts and improving triage isn’t going to cut it. The idea that we can continue to rely on humans to defend complex environments is outdated; now it’s all about a) preventing incidents from happening (all the boring building inspection stuff like hardening, dealing with technical debt, etc.), b) responding to attacks at machine speed, and c) recovering as fast as possible.
At the same time, AI is forcing changes in the organizations. There’s more code being written now than ever before, more infrastructure is being built than ever before, more autonomous actions happen than ever before, and with all that - more attack surface is being created than ever before. Similar to how the manual approach to security is breaking down in this new world, so does the old approach to inspection.
For years, a lot of the pre-emptive security was expensive because it required human understanding. Someone had to do the digging, figure out what needs to be done, what dependencies exist, who owns the thing, make sure that nothing will break (because prevention does impact operations), and so on. Whether you’re talking about patching, or hardening cloud environments, or anything in between, the operational overhead of implementing prevention was really bad.
AI can help with exactly this sort of context-heavy work: connecting evidence across systems, figuring out the original intent, prioritizing risk, proposing safe configurations, and making sure that changes get implemented without breaking anything. This doesn’t mean giving agents access to production with no restrictions, but it’s about taking the steps to make prevention more achievable from the operational standpoint, as we know that the cost of relying on detection alone has never been this high.
Closing thoughts
This isn’t about whether we need firefighters or building inspectors. The reality is that we need both to make sure our homes don’t burn down, and we need both to make sure that our companies don’t get breached. We need firefighters trained, equipped, and ready to detect, respond, and recover from the incidents. We need inspectors to focus on design, standards, and dealing with dangerous conditions ahead of time, all while knowing that, similar to how building codes require fire exits, we have to be prepared to deal with cases when all the prevention efforts fail.
This will require a lot of changes.
For CISOs, this means prioritizing prevention and hygiene as much as we prioritize detection and response. Although it may be harder to show ROI on prevention, the reality is that progress isn’t just about shortening the amount of time it takes for the fire truck to arrive, but also about making it much less likely that the building will burn.
For vendors, this means building products that do more than just “give teams visibility”. It’s surely important to know that there are problems, but we gotta move past visibility and start actually addressing them. When it comes to compliance, we have to make sure that we evaluate things continuously and not once per year.
For all of us in the industry, the biggest change is going to come down to the mindset. We become really good at detecting issues (and we should keep investing in that!), and we should now try to become as good at preventing them. If the number of fires is going to grow, we can’t hope to throw more bodies and tools at the problem, and we’re quickly coming to the point where we should pause and figure out how to reduce the probability of fires to begin with.
