I've written before about the business side of security. How the measure of a security program is ultimately "dollars of risk managed per program dollar spent", etc.

And I think some people have missed that while that's all true, it MUST operate in a broader context of global ethics. And I'm learning that far more "infosec people" than I would have expected can't be assumed to agree with that.

So on my side, expect to see me be a LOT more explicit about our duty to protect the network and community as a whole. Because tbh, that is and ought to be the whole fucking point.

If you work for a security team in an organization, your job is to help that organization achieve its purpose *while behaving safely on the network*.

Sometimes that's an easier argument—hey org, if you don't have a control here, you could lose money. Other times it's much harder—hey org, I know this is cheaper for you, but if you go this route, you're externalizing risk to other people *and that's not ok*.

But it's your job to force that conversation, and its your duty to be clear-headed about when you accept compromise in exchange for improvement, and when you draw a bright line and stand your ground on it.