Resources

So, how can we make it so that these software products are not as easily exploitable? One important improvement is the adoption of memory-safe programming languages, such as Rust or Go, eliminating entire classes of software vulnerabilities.

We also need robust security controls embedded directly into the software development process. These controls should identify flaws early and provide actionable feedback to the developers while they are writing code. Better governance of third-party components, whether open source or commercial, will reduce “inherited” risk from widely used libraries and dependencies, such as what we saw with Log4J.

Observability, Detection, and Security Blind Spots

Another fundamental challenge is observability. Do organizations have the ability to identify “malicious” or “unauthorized” activity within their systems?

Too often, logging is configured to only show errors or critical failures. Even when verbose logging mode is available, the data is frequently incomplete or lacks the context needed to understand what’s happening. Many organizations don’t treat observability as a core requirement when selecting or deploying software or consider it “production ready.”

Ask what a “normal user session” looks like from the logs, and you get blank stares. Without this ability to establish a baseline of normal behavior, we have a really tough time telling abnormal.

In a more secure future, if a digital tree falls in a cyber forest, we’d be able to hear it. Future systems will provide useful, detailed logs by default, making it easier to understand normal operations and detect anomolies.

Modern security analytic tools, far more advanced than early SIEMs, can already consume this data in real time and apply hundreds of different AI-driven digital analysts to hunt for malicious behavior and respond when unusual activity is detected. This is how organizations uncover security control blind spots before attackers exploit them.

Email as the Most Common Initial Access Vector

If attackers can’t guess your password or exploit internet-facing systems, they’ll resort to the most common initial access vector: email.

It is hard to distinguish these targeted phishing attacks from legitimate emails for a variety of reasons. Whether attackers send a malicious link or an attachment designed to deliver malware, or trick you into disclosing your password, the goal is the same. Bypass the security controls and convince someone to take action.

In a more secure future, email would operate within strict security guardrails. Unsolicited messages wouldn’t even reach users at all. Very little traffic would flow directly via standard SMTP email channels, most of coming through a specific app (like for your bank) and would be verified before showing up in your “inbox.” Today, the inbox is the quickest path to success, as we see over and over again that phishing emails are the source of many breaches.

And what about those attachments that contain the first stage of the attacker’s malware? In this future scenario, systems would only allow software installation from trusted app stores, with apps running in isolated environments, kind of like iOS and Chromebook devices today. Arbitrary downloads and execution from the internet would no longer be possible.

What Does It Really Mean to Solve Cybersecurity?

In practice, solving cybersecurity would require eliminating exploitable vulnerabilities, preventing unauthorized access, and removing the human and technical conditions attackers rely on. Today, security focuses on reducing risk, improving detection, and limiting impact rather than achieving absolute prevention.

Can Cybersecurity Be Solved?

Here’s the million-dollar question. Even if we make enormous strides by implementing all the above, technically speaking, in the security space, sadly, the answer is no.

There will always be scams. People will still fall for fraudulent requests for money, grant access to people who aren’t authorized, and misconfigure apps and systems for convenience, not security. After all, humans ignore plenty of red flags in other parts of their lives; why should this be any different?

Our best shot at solving security is to account for the human element as much as possible. In addition to employee training, we need to build systems where secure behavior is the default, attackers have fewer opportunities to impersonate legitimate parties, and protecting accounts and data is simpler and more intuitive.

I’m certain we will continue building better technical solutions, but that won’t be enough to solve our cybersecurity problem. Small improvements, applied consistently, can make a meaningful difference. Many vulnerabilities exist in systems we assume are secure simply because they are internet-facing. It is difficult to build a secure system when the components used to construct it contain hidden weaknesses.