How do you spot a security tool that is theater?
Walk a trade show floor and you’ll see security sold as a light show. Giant screens, glowing maps of the world with attacks streaking across them in red arcs, dashboards covered in widgets and gauges and live-updating numbers. It looks like the future, like command and control. Most of it does nothing.
I ran technology and security for a national retailer for two decades, and I sat through more vendor pitches than I can count. Now I ghostwrite books for security leaders. I can tell you that the gap between what security tools promise and what they deliver is enormous, and the flashier the demo, the wider the gap usually is.
This corner of the market is a racket. Every dollar a company spends on a light show is a dollar that didn’t go to patching, and the people who pay for that trade are the customers whose data walks out the door and the staff who get blamed afterward. The vendors who sold the dashboard never answer for any of it.
The flashier the security dashboard, the less it usually does. Real protection is boring. Theater has better graphics.Share on X
The number of vendors trying to sell us tools wasn’t funny. Most of the tools didn’t work. They were overly complicated, with huge interfaces and lots of doodads that looked really cool and didn’t do anything useful. The screen was the product. Underneath the dashboard there was very little.
You learn to see the pattern after enough pitches.
The demo is gorgeous, the salesperson is polished, and the slide deck carries the logos of impressive companies who supposedly use it. Then you ask the specific question, what exactly does this do when an attacker tries X, and the answer goes vague and fills up with talk of correlating threat intelligence, providing visibility and using machine learning. When I heard those phrases stacked up, I stopped listening, because a vendor who knows what the product does can tell you in one sentence.
The good tools, the few of them, can tell you plainly what they protect and how. The theater hides behind the dashboard.
That’s security theater: money spent on the feeling of safety without the substance. A company buys the impressive tool, hangs the glowing dashboard on a wall, and everyone feels protected. Meanwhile the patching, the access reviews and the backups still aren’t getting done, because that work is boring and nobody sells a light show for it. Whoever signs off on that purchase has bought the company false confidence, and false confidence is worse than none, because people stop looking.
I cover that work in the boring security work that actually keeps you safe, and it’s the exact opposite of theater: invisible, unglamorous, and the thing that protects you.
Whoever signs off on that purchase has bought the company false confidence, and false confidence is worse than none, because people stop looking.
My friend Sixto Bernal built his whole philosophy on one idea: cybersecurity is the opposite of a cost center. It prevents problems, prevents lawsuits and protects the company’s reputation, and it pays back far more than it costs. Not every company he worked with bought that argument, and executives mostly don’t see it because they don’t understand it. That blind spot feeds the theater. If you think of security as money lost, you want something on the wall to show for it, and a dashboard is easier to point at than a patch.
Why is the attack surface impossible to fully cover?
What the theater hides is that security is legitimately difficult, because the attack surface is enormous and getting bigger every year.
The attack surface is every single thing an attacker could possibly target. Think about everything you have to protect now. Servers. Desktops.
Laptops. Phones. The Internet of Things, every smart device on the network, every sensor and camera and thermostat that someone connected without telling you. And the cloud, which everybody forgets, because they assume it’s automatically secure. Your data sitting in someone else’s data center is still your problem to protect. The cloud provider secures the building and the hardware.
What you put inside it, and who you let reach it, is still entirely on you.
The surface goes further than most people imagine. It turns out attackers can build a charging cable that’s secretly a tiny computer. They leave it at an airport or a conference, you plug in your phone to get some power, and you’ve just handed them a way in through the power socket. The threat can hide in a cable that looks exactly like the one in your bag. That’s how wide the surface has become, and it’s why the idea of protecting all of it is a fantasy.
The cloud isn’t automatically secure. Your data in someone else’s data center is still your problem. People forget that constantly.Share on X
Once you accept how large the surface is, the real conclusion follows: you can’t protect everything, and nobody can. Any vendor who claims their product covers it all is either lying to you or doesn’t understand the surface well enough to be selling security in the first place, and I’d walk that salesperson to the door. The surface is effectively infinite and growing, and no product covers infinity.
| Question | Security theater | Real protection |
|---|---|---|
| What does the pitch show? | Glowing maps, blinking widgets, huge dashboards | A plain account of what it protects and how |
| What happens when attacker tries X? | Vague talk of threat intelligence, visibility, machine learning | A one-sentence answer |
| How much does it cover? | Claims to cover everything | Most likely vectors, with some far edge always exposed |
| Where does the money go? | Another wall of glowing maps | People who do patching, access reviews and backups |
| What do standards give you? | A badge on the website | Discipline to patch, log, control access and test |
| What is the result? | False confidence, so people stop looking | The boring work gets done |
My take
Walk past the vendor with the blinking dashboard. No product protects everything from cloud storage to a charging cable left at an airport, and anyone who claims otherwise is lying or doesn’t understand the problem. Protect the most likely vectors, lock down the normal stuff, and pass every standard you can. Put the money into patching, access reviews and backups. False confidence is worse than none, because people stop looking.
What does realistic security protection look like?
So you do the realistic thing. You figure out the most likely vectors and you protect those well.
You lock down the normal stuff, the servers and the endpoints and the access. You watch the places attacks come from, which, as I describe in what actually gets attacked first, are mostly social engineering and the insider, with the exotic charging cable far down the list.
And you accept that some far edge of the surface will always be exposed, because chasing all of it is a fantasy that drains your budget and your attention while leaving the likely vectors underprotected. The company that spends a fortune defending against the airport cable while its people click phishing links has its priorities exactly backwards.
Why do security standards still matter?
The last piece of real discipline is standards.
Pass whatever standards apply to you, and pass the ones that don’t apply too, whenever you reasonably can. The certificate won’t make you safe. I push for it anyway, because meeting a good standard forces you to do the boring things right, and most teams won’t do those things consistently unless somebody makes them.
A real standard makes you patch, log, control access and test. It drags you through the unglamorous checklist you’d otherwise skip, on a schedule, with someone checking. That discipline is where the value is, and the badge on the website is the least important thing you get out of it. A company that meets a serious standard has done the unglamorous work, and that’s worth far more than the most expensive dashboard ever sold.
All the same, passing the standard is a floor and not a finish line, a distinction I get into in what eight PCI audits taught me about real security versus checkbox security. The standard makes you do the work. Staying secure means doing it every day after the auditor leaves.
I’d sooner see a company spend its security budget on the people who do the patching and the access reviews than on one more wall of glowing maps, and I think the vendors who sell those maps to worried executives do real harm to the businesses that buy them. When I work with a security leader on a book, separating the theater from the substance is often the heart of it, because the person who defended an organization knows what mattered and what was a light show.
Frequently Asked Questions
Spending money on security that produces the feeling of safety without the substance. An impressive tool with a glowing dashboard goes on the wall, everyone feels protected, and the real work, patching, access reviews, backups, still doesn’t get done. The screen is the product, and underneath it there’s very little.
Ask exactly what it does when an attacker tries a specific thing. A real tool answers plainly. Theater retreats into vague phrases, it correlates threat intelligence, it provides visibility, it uses machine learning. The more of those word-clouds you hear instead of a straight answer, the less the tool does.
Because the attack surface is effectively infinite and growing. Servers, laptops, phones, IoT devices, the cloud, even malicious charging cables. No single tool covers all of it, and anyone claiming theirs does is selling theater. The realistic approach is to protect the most likely vectors well and accept that some far edge will always be exposed.
No. People assume it is. That’s the problem. The cloud provider secures the building and the hardware, but what you put inside it and who you let reach it is entirely your responsibility. Your data in someone else’s data center is still your problem to protect.
Because the work of meeting a good standard forces you to do the boring things right, patching, logging, access control, testing, on a schedule with someone checking. The discipline is the value. But passing is only the floor. Staying secure means doing the work every day after the auditor leaves.
Yes. I ghostwrite for CISOs, security founders, and technical executives who can separate real protection from the vendor light show. That judgment, earned by defending an organization, makes a security book worth reading. You can see how I work on the cybersecurity ghostwriting page.
- Shared responsibility, Amazon Web Services
- FBI & FCC Warn on ‘Juice Jacking’ at Public Chargers, but What’s the Risk?, Dark Reading
