> I want to get there, but I also don't trust anyone except (maybe) myself to determine what capabilities are "good" versus "bad". The illusion of control and

> I want to get there, but I also don't trust anyone except (maybe) myself to determine what capabilities are "good" versus "bad". The illusion of control and oversight is why Blueteams always lose in the Cyber Game. It's not feasible, and you effectively don't have time for that. The sheer amount of millions of alerts per day are the result of people still trying to spin the hamster wheel because they don't take a break and think about how this is gonna end up. Don't get me wrong, but I think this is a clustering and statistics problem. You can never be 100% secure and sure about everything, but you can always push the odds in your favor on a larger scale of nodes. Nobody cares whether a system got hacked if there was no compromise of the database and if it can be rolled back easily afterwards. That's why I believe in a fully automated approach based on a strong(er) inventory and stronger communication between systems in regards to incidents and responses.