Scale isn't the same as capability though, and cyber talent isn't exactly hard to find, just ask the Israelis (or maybe HN readers can do a bit of navel gazing)

Scale isn't the same as capability though, and cyber talent isn't exactly hard to find, just ask the Israelis (or maybe HN readers can do a bit of navel gazing). It's not fair to compare script kiddie levels tools like ransomware and cryptominer bots in the same breath as the toys from NSO group and Stuxnet. If we are counting cyber warfare capability by quantity of malware released, I would expect Africa to become a cyber "power" too in the next decade or so, because they have a large somewhat educated population and no good opportunities. I don't think most HN software engineering folks realize how easy it is to train script kiddies. Most of the big "cybersecurity" consultancies (yes even the big IPOed ones) are primarily staffed by people who basically went through a bootcamp and gained a few certifications. Corporate "security" especially is more about checklists and compliance. You are not getting any real talent like the ICs' blogs that get posted here on HN. The typical staff at cybersecurity companies won't be able to subvert broken branch predictors and post networking stacks exploits on twitter. Those sort of low level application security engineers are a lot rarer and more expensive. Many of the "cybersecurity" companies provide script kiddies and consultants without a STEM background. Forget about fizzbuzz, they are closer to McKinsey than Accenture.