In this monologue, the speaker denounces recent statements by Michelle Zaitlin, Cloudflare’s co‑founder and COO, who claimed that cybersecurity would be "solved" within a decade, likening it to water filtration. Citing Bruce Schneier’s warning that technology alone cannot fix security problems, the speaker argues that such optimistic predictions are dangerous because they mislead organizations into under‑investing in security, erode trust in technology, and could slow the adoption of digital innovations. He emphasizes that cybersecurity is a complex interplay of technology, people, and processes, and that intelligent adversaries continually adapt to any single solution. The speaker calls for Zaitlin to retract her statement or at least engage in a public debate with recognized security experts to clarify the limits of technology‑only approaches, stressing the need for collaborative, multi‑disciplinary effort to manage cyber risk.
Chapters
I am very disappointed in the recent comments that Michelle Zaitlin, the co-founder and chief operating officer of Cloudflare, recently made in regards to cybersecurity. Basically what she said is that within a decade, cybersecurity is going to be solved, it's going to go away, and, and solutions similar to that of water filtration, right, will be able to filter out attacks and so forth. And so cybersecurity will be fixed, it will be solved. She's wrong. Dead wrong. And what's worrisome about these comments is they're actually dangerous, and I'll get to that in a minute. But her comments remind me of a saying that Bruce Schneier made, and it's great. And Bruce basically said— and Bruce is a very well-known cybersecurity expert, one of the luminaries— and Bruce basically said that if you think technology will solve your security problems, then you don't understand your problems. And he's absolutely right. The reality here is technology alone won't solve it. And I get it, Cloudflare is a cloud network company. So this plays very well into a marketing and sales narrative. So that may be why she stated this. And, you know, let's back up Cloudflare. Well, it's a unicorn. It is a massive multi-billion dollar company that just went IPO not that long ago. And I think it's the technology that they have is great. In fact, I even bought their stock after IPO, and I've loved what they've done for DNS around the privacy for their DNS services and so forth. I mean, it's great, some very, very smart people there. And Michelle, co-founder, COO, she is obviously very intelligent, an expert in technology and in business, but we need to keep in mind that doesn't necessarily translate to expertise in cyber. Security. It's a different world. It really is. And her comments are detrimental to everyone. Now, very smart people have made comments like this before. This isn't the first time that we've seen technologists make these kinds of claims. In fact, I've worked in— across my career with some of the most brilliant engineers and developers in hardware, firmware, software, and sometimes they will come out of their comfort zone and they will look at cybersecurity and go, "Oh, I can fix that. I can solve that." No, you really can't, right? Cybersecurity is a combination of technology and people and process, and you don't get to fix something by just addressing one aspect of it. The reality is engineers, the engineering mindset is about making something that works functional. And if it's broken, well, then making a fix for it. Cybersecurity is really around intelligent adversaries that are smart. They will go around, over, through, or under. They don't play by the rules. They're incredibly creative, and they may even be smarter and more resourceful than you. And so it just simply doesn't work. And I've seen these brilliant technologists, and I've had conversations with them to say, no, you can't actually fix security. Um, they go, oh no, I can. And they come out and they, they create a solution and they put it out there, and immediately the attackers go around it. Okay, well then they go out and create another solution, and again the attackers go through it or around it or under it. And And it takes a few iterations before those brilliant engineering minds take a step back and go, "Yeah, you're right, I didn't understand the problem." Yes, technology alone can't solve cybersecurity. So here's where the damage comes in. When an influential person comes out and says, "Security will be taken care of." in a decade, right? It'll be gone. We'll have filtered all that stuff out. Organizations then will hear that, and already fearful and concerned about security, they hear that and they hear what they want to hear. We don't have to invest, it's going to get taken care of. And all the work the security industry has done over the past several years to show and earn a seat at the table, to identify the relevance and the importance and the growing challenges, all that gets swept away because of ill-informed comments. That undermines the trust in technology because those organizations and the services and products and the people that listen to that, they will get victimized more and more, and that will make them pull back. And erode that trust, and that undermines the investment in innovation, in adoption. That slows things down, and we don't want technology to be slowed down. In fact, we want the opposite. We want to gain the benefits of technology innovation while managing the risks. So these types of ill-informed comments are dangerous to everybody. It's dangerous to the continued health and growth and adoption of digital technology. So what I would like to see is I would like to actually see a retraction. And I think it would be very mature for her to come back and go, okay, there's not going to be a silver bullet. Our organization is going to partner and work with many other organizations and many other technologies and many other aspects, including behavioral and process to help manage the risk. It's gonna be a challenge. And in fact, it will take a lot of collaboration and innovation just to keep pace with the innovation of the bad guys. Now it will take an exponential level of beyond that to actually gain ground, but it's a teamwork effort. And I think it would be very irresponsible for her in her position to come out and say that, to make that clarification. Because no, cybersecurity problems don't go away in 10 years. They don't. And the water filtration analogy has been tried, by the way, many, many times in many different ways, and it has not worked. It's failed every single time. And if she doesn't actually believe that, then I would propose Let's have a public debate. Let's bring in on one side, the security experts and luminaries, and we can explain how this has been tried before, why this fundamentally fails, what's gonna happen in the potential damage in going down this path. There's lots of information. In fact, when we look at intelligent adversaries and the strategy and tactics around it, it's, there's a tremendous amount of documentation dating back to the time of Sun Tzu, And on the other side, she could bring in, well, she's gonna be hard pressed to find any credible cybersecurity people that would back her claim. So she can bring in technologists or whomever she wants, and she can make the arguments. But I think that conversation, that debate, would be very insightful to the people who might be swayed in thinking, oh, security will be taken care of. It'll be solved, I don't have to do anything. It's important that they don't fall into that trap because of marketing and sales tactics. So I hope that Michelle and other people who think that technology can be that silver bullet to solve cybersecurity, I hope they get this message.
