There is a logic to it in a way, but I think it goes too far. The security industry should strive to not have to broadly re-evaluate practices based on surpris

There is a logic to it in a way, but I think it goes too far. The security industry should strive to not have to broadly re-evaluate practices based on surprises. Shock and surprise are fine, but they shouldn't cause a scramble of reactionary work, since that work should have been done in anticipation of the potential threat.