The quality of offensive tooling has somewhat improved during that period.
That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec, societal structures, and kinetic cases. Is this just a base truth?
https://en.wikipedia.org/wiki/Lord_Mountbatten
I see The Troubles, as a civil war in UK.
So you're starting this all over again eh?
Try kicking over a building sometime. (Or don't - you'll stub your toe).
Tangent aside, entropy favors the attacker even in the case of a building that has PE stamps on the plans and passes all codes at time of construction. Just leave it alone for a while with no maintenance, it will fall. Or, hire one man to correctly place charges. Far less work than what it took to build it.
edit: I want to make clear that what amazes me is how hard we fight entropy. We have built fragile societies, fragile technologies, we ourselves are fragile. And yet, humans are generally pretty cool and choose not to destroy all of these things, though we do have a few assholes amongst us.
I'd also expect the offensive side of hacking into systems will greatly benefit from LLMs finding an almost endless series of new vulnerabilities in even crappier llm software. I'm just so cynical.
Consider the energy requirements to construct a skyscraper compared to the energy requirements to demolish one.
Digital Operational Resilience Act (DORA) and Cyber Resilience Act (CRA) which enforce mandatory governance and processes like resilience testing and cybersecurity lifecycle requirements.
GDPR & Data Protection frameworks which requires architecture to support CRUD operations on all PII, data minimization, customer-managed encryption architectures and so forth.
...and the anti-vibe code framework aka the EU AI Act, which requires human oversight and data quality controls.
This is completely aside from any industry specific engineering codes like in Finance where you have to adhere to things like ISO 20022 or iXBRL/ESEF standards, user accessibility mandates, and PCI Compliance mandates for things like Security Architecture over and above the CRA.
required codes and standards may raise one (difficulty of removal) or both (difficulty of removal + difficulty of construction) in varying proportion.
I wonder if that ever expands to traditional software when the stakes and blast radius increase significantly with time.
On the other hand, "You wouldn't download a wrecking ball?"
Eh, kinda. The defenders have the advantage of playing on the home turf. They know their infrastructure, can have sensors and traps everywhere. The bad guys are stumbling in the dark. They have no idea what's real and what's a honeypot, what signals you're watching, etc.
The problem is that almost no one takes this advantage seriously. If you're not paying attention to your infra, yeah, you're gonna get owned.
They can have, but they’re sufficiently tied up with other corporate busy work that they don’t.
I have designed and audited systems for dozens of orgs that protect hundreds of billions in value and regular transaction volume. HSMs, remote attestation, quorum controlled servers with custom and fully audited operating systems, and in some cases a geodistributed network of underground bank vaults, NSA tempest spec zero emissions chambers, and security down to the laws of physics.
Security can be assured with high confidence for the right price, but very few are willing to pay for it and fewer still experienced enough to offer it. 15-200k a week is common depending on reputation, but I know at least one that claims to bill 1m/w.
Personally I do not believe hoarding effective security tactics for private audiences is ethical, and thus I insist any security work and research resulting from my work for employers, clients, and my own companies must all be freely licensed open source. No exceptions for any amount of money.
Security will be normalized when it as open, cheap, and too easy to justify not doing.
Shameless plug, this is why I co-founded Caution.
When you operate in an environment where every "good boy" can be wiped by a single "oh shit", statistics are against you. That is a base truth. The failure can rest on negligence but negligence isn't a necessary component for failure. For attackers their failures are wiped by a single success, for defenders their successes are wiped by a single failure.
In a different life I worked on designing and implementing similar systems to the ones you described, except with even more money going through them. They can can still be hacked, at incredible expense. And the hackers could even make a huge profit with the treasure trove they have access to. But getting away with it is orders of magnitude more difficult than the hack. The money involved to make the hack profitable is impossible to hide on the world stage. It takes a lot of political capital and military to be able to steal billions+++ and get away with it (nation state attackers, not just a group of hackers). So hackers go for lower risk jobs where the payout can even be similar just because of the lower cost to succeed.
https://www.washingtonpost.com/politics/2026/03/10/social-se...
When I interview production engineers I expect them to know Linux down to the system calls. 9/10 fail, including the ones with decades of paper experience who are mostly coming from major companies. Of those that pass, I find out with little surprise, almost all use Linux as a daily driver, and have backgrounds in projects like buildroot, gentoo, and yocto. Most of the 9/10 that fail are full time MacOS users, so they never stood a chance to develop the required low level Linux security skillsets which are hard won from constant immersion and usually deep involvement in the community.
If you configure a system properly, with a purpose built kernel and OS for the job with hypervisor sandboxed remotely attestable, minimal, and provably correct constant time workloads the only way it is getting compromised is with a novel CPU flaw or hypervisor escape. Vulns of that class are VERY valuable, very rare, and blackhats will not waste them casually. If an attacker does not stand to make tens of millions, they will not risk exposing such a vuln. If that kind of value IS on the table, then you need to hire 3+ engineers that specialize in airgapped computing and hardware security modules. Factor in a 4-5m/y+ budget just for a small highly skilled security team. Most companies cannot or will not stomach that kind of cost, so they hire anyone willing to work for a typical engineer salary with a macbook who pinky swears they can run debian in production with high security even though literally no one alive can do that.
It's much harder to have perfect opsec and never be caught for the wrongdoing. The other side only needs patience.
The whole “you don’t have to outswim the shark, just the guy next to you.”
edit to the downvoters: is it easier to exploit software than to create exploitable software?
Do you think Donnie loses a microsecond of sleep over this?
($400 million no-bid contract goes to Oracle paying 5x as much per person, misses deadline for every key milestone, after one more $200 million extension claims government terms were impossible to meet and never delivers anything useful)
18F -> https://ndstudio.gov
As seen credited on recent publications like real realfood.gov.
(Ill note that this design studio is being led by newly proud white nationalist Joe gebbia who apparently blames illegal aliens and their ‘anchor babies’ for high housing costs apparently while unironically forgetting he cofounded airbnb: https://substackcdn.com/image/fetch/$s_!VCGY!,w_1272,c_limit... - I mean look at these posts back to back, I wonder why they’re unable to recruit anyone: https://substackcdn.com/image/fetch/$s_!ArmA!,w_1272,c_limit...)
Although I personally wouldn't lift a finger for the corrupt Christ clowns that run America these days.