I think the distinction between cybersecurity and sre is that cybersecurity risk is much harder to quantify. Cybersecurity is full of things that are both very

I think the distinction between cybersecurity and sre is that cybersecurity risk is much harder to quantify. Cybersecurity is full of things that are both very unlikely and very bad if they happen. What is the risk of some vuln burried deep in the stack that likely nobody will ever notice and even if they did even more unlikely they can further use it as a pivot point? Hard to say, but maybe close to zero unless you are a company that people specificly target. At the same time it can be a business ending risk. With SRE , even in the absolute worst case you can spin up new servers. You can't unleak your customers sensitive data. I think cybersecurity is hard because we are uniquely bad at evaluating cybersecurity risk which means we are bad at figuring out what appropriate mitgating action is