Yeah that chimes with my experience. "Cybersecurity" (a name I hate by the way) without threat modelling and analyzing trade-offs is just compliance. There is a

Yeah that chimes with my experience. "Cybersecurity" (a name I hate by the way) without threat modelling and analyzing trade-offs is just compliance. There is a lot of bike shedding, cargo cults and general bs "box checking" work. So many players selling "AI" and visuals in the form of overly complicated "scanning" and CVE database querying, which is little more than checking and matching versions, or circular metadata writing and reading. I got in and out of the field in about a year.