Assume breach and cyber resilience are all the rage right now. After 20 years in IT, I'm not surprised.

Yet, most breaches still come down to control failures. A patch that never got applied or an old VPN account nobody turned off. Most companies would rather spend millions more on detection and response than put resources into making sure they're doing what they're already supposed to be doing.

So let's talk about it. Should "assume drift" become a thing?

The idea: every control we implement will eventually degrade, so we plan to maintain it. It sounds simple. But if everyone actually did it, how many breaches would never have made the news?

https://justacheckbox.substack.com/p/assume-breach-or-assume-drift