The idea of a "security poverty line" is close to my heart, and more relevant today than ever. It's important to understand the complex dynamics that keep organizations from being secure; it's not just a matter of spending money or having the will. https://twitter.com/duosec/status/1359159621043318787

Too many non-practitioners chalk up insecurity to the organization being lazy, stupid, apathetic, or malicious. But when you really look into the causes of an incident, you'll see a web of constraints and attempts to do the best with what they had at the time.

I am certain that we don't understand all the factors that underlie security poverty and how to fix it; it's as complex an issue as health care reform is in the US. I just know that we need to work on learning more, not scolding more.