I used to do this for a living and went on to work for a splunk partner.

This company was run like ass from an inside perspective. Made me realize how most of Splunk isn’t for making things secure, it’s to bring your insurance premiums down. I’ve certainly seen insecure setups with Splunk often and it’s a huge myth by having it you’re more secure. Doesn’t count if you run it as root and I was amazed how many major companies did exactly that.

Cured me of taking most of the security space seriously when I saw how the sausage was made. Most of its bunk and games with an insurance premiums. Literally companies would pay to just set it up then never touch it or turn off all the alerts. Didn’t matter though because by having it the insurance premiums went down. Just a money game. Very little to do with security.