I've written before about the business side of security. How the measure of a security program is ultimately "dollars of risk managed per program dollar spent", etc.

And I think some people have missed that while that's all true, it MUST operate in a broader context of global ethics. And I'm learning that far more "infosec people" than I would have expected can't be assumed to agree with that.

So on my side, expect to see me be a LOT more explicit about our duty to protect the network and community as a whole. Because tbh, that is and ought to be the whole fucking point.

If you work for a security team in an organization, your job is to help that organization achieve its purpose *while behaving safely on the network*.

Sometimes that's an easier argument—hey org, if you don't have a control here, you could lose money. Other times it's much harder—hey org, I know this is cheaper for you, but if you go this route, you're externalizing risk to other people *and that's not ok*.

But it's your job to force that conversation, and its your duty to be clear-headed about when you accept compromise in exchange for improvement, and when you draw a bright line and stand your ground on it.

It's beyond frustrating, but it's not *new*. It's just that the AI push and a few other things going on in the industry and wider community are shining a spotlight on how much we've lost our way.

Infosec, IMO, should be about ensuring that when people and organizations want to do stuff (even cool stuff!) with information, they don't get to ignore safety. They don't get to play fast and loose with data they're custodians for. They don't get to put other people's data and systems at risk to save a buck or "move fast".

Of course compromise is always going to be a part of that, but we should be the people who are asking the hard questions and pushing for better decisions.