So, as per usual, an anecdote. In high school, as a budding Middle East geek, I was told to apply to Saint Andrews of Scotland. Ironically, beyond golf, they

So, as per usual, an anecdote. In high school, as a budding Middle East geek, I was told to apply to Saint Andrews of Scotland. Ironically, beyond golf, they had a top notch group of counter-terrorism experts in their security studies (the fact that this was what dawned on people when I studied Arabic in HS without question should have been a red flag for Arabic language academia in the West, but I digress). I never went, but they said another guy in my high school years before did. What did he end up doing after studying with these guys? The state of Illinois in the US apparently had a rare Office of Counter-Terrorism (as did NJ, but it was reorganized into their state level DHS) and all he did was analyze the physical security and threat risks around reservoirs and other infrastructure. Primarily reservoirs. If you are worried about the software stack, you are wasting your time. The end game is far easier and just requires jumping a fence.