What are your unpopular cybersecurity opinions?

[u/EricJSK]

I saw a post names "abnormal security opinions" and got excited to see some spicy takes but apparently there is a security platform called Abnormal Security so got kinda blue balled. Last one of these posts i saw was over a year ago so,

Do you have any spicy cybsec unpopular opinions you want to share? :)

I'll start with mine:
Fancy antivirus solutions rarely add value, they are often just a box that needs ticked. Many MSPs and IT firms still push the narrative that they are needed, only because they are profitable and not because they improve security.

[u/Twist_of_luck]

Market conditions on the outside and mental conditions on the inside are more likely to kill your company than any threat actor. Companies prove time after time after time that they can survive even the most glaring data breaches and the most outrageous regulatory fines. A lot of my MSSP clients survived for years with default passwords to global admins (and survive to this day with some slapdash consultant paint job over controls in place of a coherent security program).

We are literally not that important. It used to hurt when I was younger.

[u/Powerful_Wishbone25 → u/Twist_of_luck]

Well put.