Are you saying technology does not matter?

No. Technology matters a lot, and most organizations underinvest in fundamentals like asset inventory, identity, and patching. The point is that adding more technology on top of an unprepared team does not move the outcome.

What does an investment in people actually look like in a security budget?

Communication training, decision-making exercises like tabletops, paid time for analysts to develop technical depth, manager training that is not just about ticket throughput, and a hiring process that selects for judgment instead of trivia. Most programs spend less than five percent of their budget here. It should be closer to twenty.

How do I convince a board that the people layer is the gap?

Walk them through your last three incidents and identify the human decision point in each one. Then show them what training, staffing, or process change would have changed the outcome. Boards respond to specific stories with specific dollar figures, not to general statements about culture.

Does AI change this argument?

It sharpens it. AI handles more of the pattern work, which means the work left for humans is exactly the high-judgment work that requires the skills most teams have not invested in. The people layer becomes more important, not less.

Where should a CISO start if the budget is already locked for the year?

Start with one team. Run a six-week experiment on decision rights, communication, and ownership. Measure mean time to triage, mean time to escalate, and analyst-reported clarity. Bring the results into the next budget cycle. You do not need permission to run the experiment.

Cybersecurity

The Future of Cybersecurity: Why People Still Beat Technology

Cybersecurity spending crossed two hundred billion dollars. Breaches went up anyway. If technology were the answer, we would already have the answer.

The takeaways

01The stack keeps getting better. The outcomes are not keeping pace because the constraint is human, not technical.
02Most breaches still start with a person clicking, misconfiguring, or being socially engineered.
03Zero trust, XDR, and AI are useful tools, not strategies. A strategy includes the people who run them.
04Talent shortage is real, but it is also a symptom of how the industry hires and develops people.
05The teams that will win the next decade are the ones who invested in communication, judgment, and ownership, not just licenses.

Every year the analyst firms publish the same chart with a different label. Global cybersecurity spending is up. Breach counts are up. Average dwell time is down a little, average breach cost is up a lot, and the gap between attacker capability and defender readiness has not closed. If you held the chart up next to one from 2015 and swapped the dates, most people would not notice.

That is the part the vendors do not want to talk about. The technology keeps getting better. The outcomes are not. There is only one variable left to look at.

The technology is doing its job

This is not a complaint about the tools. Modern EDR catches things signature antivirus never would have. Cloud-native SIEMs ingest volumes that would have crushed an on-prem deployment a decade ago. Zero trust architectures genuinely reduce blast radius. Identity providers have made MFA something a non-technical user can actually live with.

If you graded the technology in isolation, the industry has made real progress. The problem is that you do not get to grade it in isolation. The technology lives inside organizations, run by humans, against attackers who are also human.

Where the breaches actually start

Look at the post-incident reports for the last twelve months. The opening move is almost never a novel zero day. It is a phishing email a tired person clicked, an S3 bucket someone left public, a third-party token that was never rotated, an MFA fatigue prompt that finally got approved at two in the morning, a developer who pasted a secret into a public repo, or a help desk that reset a password for someone they should not have.

The technology was there. The technology often even flagged it. Someone closed the alert, or no one was watching, or the runbook said escalate and there was nobody on the other end of the escalation.

The talent problem is a people problem in disguise

The industry has been telling itself there is a talent shortage for a decade. There are roughly four million unfilled cybersecurity roles globally. That number does not move much no matter how many bootcamps run.

A shortage of bodies is not the real issue. The real issue is that the industry hires for the wrong things, then wonders why retention is bad and burnout is high. Job descriptions ask for ten years of experience in a tool that has existed for four. Interviews test trivia instead of judgment. New hires are dropped into a SOC, handed a queue, and asked why they are not communicating better with the business they have never been introduced to.

Fix the people pipeline and the tools start to actually return what you paid for them.

What the next decade actually rewards

The security programs that will look good in 2035 are not the ones with the biggest stack. They are the ones that did three unglamorous things at the same time.

They built communication into the role. The analyst who can explain risk to a product manager in two sentences is worth three analysts who cannot. This is a teachable skill that almost nobody teaches.

They made ownership clear. Every alert has a name on it. Every system has a name on it. Every decision to accept a risk has a name on it. Ambiguity is where breaches live.

They invested in judgment. Tools surface signals. Humans decide what they mean. The teams that practice that decision-making, in tabletop after tabletop, get faster at it. The teams that just buy more tools do not.

This is the entire premise of the Secure Methodology and of The Smartest Person in the Room. The technology is necessary. It is not sufficient. The variable that has been ignored the longest, the human one, is the one with the most upside left.

The future of cybersecurity is not a smarter tool. It is a team that knows how to use the smart tools it already has.

“Every new layer of technology eventually meets a human, and that human becomes the decision point. You can either prepare them or pretend they do not exist.”

Frequently asked

Keep reading