I agree with most of this, but want to throw my two cents in. Re: The cloud I used to say that snarky thing proudly, and then I worked on AWS services for a y

I agree with most of this, but want to throw my two cents in. Re: The cloud I used to say that snarky thing proudly, and then I worked on AWS services for a year. Yes, many of them are seemingly overcomplicated. No, you should not go to the cloud to save money. Yes, you should go to the cloud for a host of potential reasons. One example is IAM. In AWS, every single thing that one can do is controlled by the same policy language and user/role/action framework. Even if the policy is (very woefully) expressed in JSON and not one of a dozen more appropriate languages, it is an incredible feat of IAM to have so many disparate tools controlled with the same language. Re: Security through Obscurity I put my SSH ports for lab boxes on port 222. My auth logs drop by orders of magnitude. It doesn't mean I weaken my password or SSH cert, but it means my logs are cleaner, the chance of getting pwned by a 0day are just that much less, and those are benefits. Re: Open source I love FOSS. I don't think it is the end-all and be-all of security, though. And when it comes to cybersecurity tooling, I would much rather use certain closed-source NGFWs than opnsense/snort at the perimeter of a large organization. Disclosure: I work for one of the NGFW companies. Point is, seeing the code isn't the last bastion of security. Re: Compliance Yes, yes. OP is correct. It is needed, but is not the end-all. A competent audit/compliance regime sets up requirements and recommendations specific to your organization based on government regulation and industry best practice. They will work with you on what is a hard requirement and what can be justified as a mitigated measure, balancing the law, the threat risk, threat likelihood, and compensating controls. At best, they are partners with Infosec, pushing management to do what Infosec knows needs more focus, and slows down management that doesn't want to spend money, or just wants to "move fast and break things". So yeah, this person knows what they're talking about.