Two things have worked for me: - rationalizing leads to increased personal agency: you now know enough about a topic to know how things actually work, vs. how

Two things have worked for me: - rationalizing leads to increased personal agency: you now know enough about a topic to know how things actually work, vs. how the abstraction talks about it working. You've jumped over the abstraction wall, and that's a good thing - you're playing with the real deck of cards now. Would you rather be blissfully unaware and have your world ended by one of these security events, or be aware and take meaningful risk controls to protect yourself and your relevant loved ones. I will say with technical knowledge I have, buying older, less connected cars and doing a little bit of emergency prepping suddenly doesn't seem at all insane. Pre-UKR war, I pulled out cash from ATMs in the event NotPetya 2.0 was unleashed. It sounds nuts except for the fact that NotPetya shut down Maersk and iirc FedEx. - align incentives: tech is a business. tech is a business. tech is a business. in the most cyncical but still accurate evaluation, it is run by MBAs/Lawyers/product owners/ex-founders who joined the dark side and leverage idealistic "for the love of the tech" types like yourself to build great products... which is not always great tech. find places to work at that have the maximum incentive to take security seriously, and the security profession suddenly will suck less. parts of government, cryptocurrency exchanges, ICS firms like Dragos, places like that.