-> this post, I wrote it on May 30, 2025.
And since then, I have seen in the private messages I receive that many did not understand what I meant.
Some are surprised to still see me talking about vulnerabilities, Linux, hardening, architecture, monitoring, mitigation, exploitation, compromise, threat models or server security.
But I never wrote that I was giving up security. I wrote that I was leaving the world of cybersecurity, and the nuance matters.
I did not leave the discipline, the practice, its technical reality, nor the instinct to watch for weak signals and ask: "where does it break?"
What I left is the ecosystem that grew up around it, which was no longer for me: the theatre, the noise, the badges, the posturing, the labels, the PowerPoints, the audits that had become ceremonies, the certifications and the standards that had become the objective instead of the tools they were supposed to be, the frameworks turned into dogma, or more generally the people who confuse compliance, security and operational competence.
I left a world that had become absurd, in which a system would be secure because it ticks the right boxes.
So no, I have not changed my mind: a system is secure because it withstands attacks, because it limits the impact of an incident, because it detects incidents quickly, because it compartmentalises correctly, because it leaves usable traces, because it trusts nobody, because it makes it possible to understand what happened, because it can be corrected, and because the people who operate it know what they are doing.
Security is not a PDF, an Excel spreadsheet, any more than a mention in a tender document or a certification displayed like a medal.
Security is about reality, and reality does not follow procedures to please auditors. It does not give a damn.
– A flaw in a kernel module does not wait for a committee to validate a risk matrix.
– An attacker does not stop because a provider is certified.
– A data leak does not become less serious because an organisation can produce a compliance report.
– A compromise does not disappear because it is properly documented after the fact.
Standards, frameworks, audits and processes are useful: as long as they are used as tools to serve the goal. But they become dangerous when they become the objective and replace judgement, engineering, competence, and when they are nothing more than alibis that produce administrative rather than effective security.
That is exactly what pushed me to leave this world. Part of the sector started confusing the map and the territory. Started replacing the search for effectiveness with the search for compliance, deep understanding with external validation, experimentation with respect for procedures, and technical intelligence with the fear of stepping outside the rules.
So yes, I continue to do security. Every day.
I keep up with developments, I harden servers, I analyse vulnerabilities, I write exploits to put my systems to the test, and I design mitigations before the official fixes are available. I think about isolation, about zero trust, and I continue, whenever it is possible, to favour simplicity, traceability, separation of privileges, reduction of attack surface and the ability to respond.
In my universe, that is cybersecurity, but it is not necessarily "the world of cybersecurity". And that is precisely what many did not understand in the message I wrote last year.
You can practice a discipline without belonging to its industry. You can defend a security approach without subscribing to its bureaucracy. You can stay technically active without taking part in the circus. You can stay close to operational reality outside the system and without having to respect its social codes.
Today, too often, people document before they understand. They certify before they master. They standardize before they put things to the test. They buy a solution before knowing which problem it solves.
That is not my way.
I am not saying that it is bad, or that all the players are incompetent. There are plenty of brilliant people, solid teams, exceptional researchers and engineers who do remarkable work. It is simply that the dominant ecosystem, for its part, has changed in nature.
And that is the world I left.
So no, I have not stopped doing security. It is a discipline present in everything I do, a way of reading reality that I apply to everything. When you have spent a fairly long part of your life looking for where systems break, you never really stop doing it. But the difference is that I do it my way.
Have a good weekend, everyone, and take care of your information systems ;)
—
Christophe Casalegno
https://all.bo
1 comment