Schneier on Security

GregW • August 30, 2026 7:49 AM

Regarding “the tools that merely tell you how bad things are seem to be frustratingly plentiful”.

I have additional observations and a diagnostic/corrective.

The benefit is not just a tool-marketing one as pointed out by @ForProfit.

There is a second reason this flourishes. Showing a bunch of (often false positive) security concerns also helps the CISO internally market that there is a big problem here that needs more budget.

Internal technical teams who recognize this are disincentivised to say the emperor has no clothes because the three departments whose antagonism can be career-ending are HR, Finance, and Cyber.

Instead internal technical teams are incentivized to fix the vast number of false positives (when they are easy to fix) and only argue about bad information from the tooling when it is extremely difficult to fix. The feedback loop needed for good decisions is limited. And the winning move for certain types of leaders is to use a SaaS tool whose security structure is opaque.

You can know whether the tool vendor cares about the problem “for real”, not just for marketing, by their feature set. If the tool enables and incentivizes downstream non-cyber teams (who have much richer context) to report+track on perceived false positives vs perceived true positives, preferably with a confidence rating, then the rational feedback loops and prioritization can occur, and the centralized cyber team can be more aware of how well the tool itself is generating meaningful warnings for the organization. Anything less is just a cheap sales job.