Why I refrain from infosec punditry

If you know about my professional background, the most puzzling aspect of this Substack must be that I don’t use it to talk about my primary field of expertise: information security. In fact, it feels like self-sabotage; most of people who recognize my handle would probably rather read my take on Mythos — the new LLM tool from Anthropic that’s promising to revolutionize vulnerability discovery — than listen to what I have to say about chicken coops or the foundations of math.

The reason why I keep biting my tongue is simple: I dabbled in infosec punditry for nearly two decades, but I’ve come to realize that it’s a way to make yourself busy without accomplishing anything. The industry deals with nearly-constant drama — new breaches, new product claims, new controversies — but almost none of it has any bearing on long-term trends. As a practical example, cryptocurrencies and the associated ransomware industry have reshaped the landscape of enterprise security far more than any advances in vulnerability research. Heck, even on the topic of vulnerability research, the discourse is often dictated by PR efforts, not reality. In the 2010s, you’d see dozens of stories about symbolic execution research from Microsoft; I don’t recall a single Ars Technica article about Address Sanitizer, an unassuming open-source feature that helped squash tens of thousands of bugs. I have many other spicy examples, but all I’d accomplish by listing them is upsetting some of my peers.

The relentless pace of infosec drama also makes our punditry remarkably shallow. You’re not doing deep dives; you’re offering TikTok-level hot takes on the headline of the day. You’re right half the time, wrong the other half, and you’re usually rewarded simply for saying things that are provocative, with no one holding you accountable if you miss the mark.