text: Going forward, I will make comparisons between security and meteorology, which we share many similarities with.
  From 1900 to 1950, meteorology is marked with discovery, theory, and experimentation. 1950 and onward is easily described as a global effort to build data rich, accessible, and quantitative prediction infrastructure.
  Much like pre-1950 meteorology, the history of computer security has always been about of innovation. We’ve invented and built most of the tooling, infrastructure, skills, and language so that we can perform jobs that mitigate risk. We have a proud industry that proves our concepts, but we’re failing.
  It will require massive collaboration, activism, regulation, and agreeable forecasting methods to take advantage of it.
  Probabilistic security infrastructure should make our efforts as an industry, disparate security teams, and community, far more efficient and rational.
  I view our collective progress so far as a constellation of disparate security innovations, mostly independent of one another. Singular products, innovations, systems, tools, or norms that have helped us mold our own unique security programs.
  Until we can unify and direct these efforts into a rational approach to the security problem, we resemble an unfocused mass of conflicting goals.
  It is roughly described as “quantitative decision making” and it’s a foundation for nearly every industry that has found a way to mature and scale.
  Once an industry has the necessary war chest of tooling and innovation, it begins intense measurement of itself to compete or produce at higher levels.
  A strategy of investments in measurement, iterative improvement, and quantitative decision making is present throughout.
  The root cause of this issue is quite ironic. We do not invest in prolific tracking of data breach root causes.
  The tough part is: Even with plentiful root cause data, a modern security team rarely knows what to do with this information. They wouldn’t know how to contribute back to it, or measure their progress towards reducing the likelihood of outcomes related to these root causes.
  Security teams that do not quantitatively measure a reduction of risk over time are simply hoping that their actions will change a future outcome. Hope is no strategy, and these actions are easily comparable to a rain dance, a cargo cult, or that cliche quote about insanity and expecting results.
  I’ve previously believed that information security risk is too nuanced to be seriously measured in true quantitative ways. I’ve felt that measurement methods would not be as efficient as the intuition and leadership of talented individuals who develop strategy for a security team. I’ve since been convinced otherwise while coming to understand the role scenario based forecasts and rigorous estimation across a variety of industries.
  In my working with many security teams over several years, nearly all exhibit substantial bias and irrational intuitions towards risk by few influential people. The teams I have run have suffered the same, by my own doing. This is especially evidenced by how drastically one company, or team, will approach risk from the next, even within the same competitive sector.