The security industry is a high paid specialization in an already highly paid industry, and it attracts an enormous number of complete charlatans. It’s incredib

The security industry is a high paid specialization in an already highly paid industry, and it attracts an enormous number of complete charlatans. It’s incredibly easy to be a security charlatan, most of the people you work with won’t understand what it is you’re supposed to be doing, so they won’t know any better when you tell them to do literally anything at all. You can create an endless stream of busywork for yourself, by making an endless stream of nonsensical risk assessments, and anytime you don’t know what to do you can just say no. Anytime you’re questioned you can just say it’s best practice, and chances are some authority at some point in time said it was. Other risk-related fields typically have at least some of the same issues. Risk avoidance is always a no-effort strategy, and the industry is full of people who rely on it entirely, because they don’t have the skills to implement actual mitigation strategies.