Outside regulated industries like defense, cybersecurity has always been pushing rope. Around 2013, with the rise of CryptoLocker, ransomware began to change that. Once CEOs started hearing about peers who couldn’t ship product, make payroll, or get paid, budgets finally moved. That’s why the pitch is now regulatory capture and scary AI agent hackers. Fear sells.
The tools are powerful and the velocity is shocking. The controls, however, remain largely traditional. They require strategy, discipline, and meaningful investment in more than just tools. How robust those controls actually become will keep separating well-run organizations from reactive ones.