I've spent a decade in information security and I've been working as a consultant from a security vendor for the past few years, and yeah there's been a big out

I've spent a decade in information security and I've been working as a consultant from a security vendor for the past few years, and yeah there's been a big outpouring of cash for security. Unfortunately it's almost never spent right and most of it goes to waste. So you don't need to worry about a corporation having a standing army when it comes to information security, because that army doesn't have guns and isn't allowed to engage the enemy. An army, yes, but they're defending the Maginot Line [1] I have a customer whose SIEM generates several hundred high severity alerts every month, and they've told me that those alerts are 90% accurate and it's a real actual high severity security incident on every true positive. We've tried to get them to put controls in place to prevent the activity rather than merely responding to the incident after it was detected, but doing so would cause a workflow change for some business units, and they can't do that. All they can do is detect and respond, not prevent. To compensate, they hired more security analysts to respond faster, and bought more tools to detect quicker... but they're still just responding after the fact. The security incident already happened. Millions of dollars per year wasted. And this isn't uncommon. [1] https://en.wikipedia.org/wiki/Maginot_Line https://en.wikipedia.org/wiki/Maginot_Line