marcus0x62

What’s the alternative?

Some functional skills are rarer than others, some are simply harder to master than others, and some are both.

To me it would be unfair to force equal pay for very unequal work.

I’m not a doctor, but some quick googling indicates that trichinosis symptoms start after a few days of being exposed to the worms, while scurvy symptoms show up after a few months of vitamin C deficiency[0].

I’m pretty sure I - as an ignorant person in this area - could figure out if people around me sometimes ate something, and then got sick within a few days, that maybe I shouldn’t eat that thing.

I doubt I’d be able to figure out that I should eat something on the basis of people getting sick after not eating a whole bunch of things for a few months.

0 - at least one source I found claimed scurvy symptoms could show up as soon as one month after “severe” vitamin C deficiency, but that “more noticeable symptoms would appear later.

You like to make absolute statements like “always”, but I know of large organizations (Fortune 500) that use Proofpoint, but not Microsoft email security. And in endpoint, there are shops that license defender as part of an EA, but don’t use it - of course, those seats go into the Forrester figures that Microsoft likes to tout.

That’s great. For you. Most businesses don’t have the ability or desire to build every single security tool they use in-house or use open source for everything. So they buy commercial tools. Which are audited by third parties to give the companies that use the commercial tools some idea of how their data will be used.

If google wants to maintain those audit findings, which they’ll need to do to keep most of their customers, that’s going to limit the kind of data collection they can do. Unless, of course, you want to propose a new conspiracy theory (which I guess would be par for the course in this thread) that Google is going to lie to their auditors to get at that sweet, sweet data (most of which they already have for their GCP customers and don’t need to buy Wiz to obtain.)

That is a tiny part of what those companies do and was mentioned nowhere in that post.

You’re responding to something that isn’t there.

I understand those (I haven’t used them) to primarily be about software composition analysis. Wiz does that, but they are mainly known for Cloud Security Posture Management (the “you have an exposed S3 bucket”, “you have a workload with no inbound firewall”, “etc.”) and integrating things like SCA to increase alert fidelity (do you care as much that a workload has an inbound ACL allowing MongoDB connections from the Internet if the workload isn’t running MongoDB?)

This thread is talking about Wiz. The comment you responded to was about the fact that security company founders often have intelligence community backgrounds and/or come from adversary states (from a US/European perspective.) It had nothing to do with VPN.

Based on the exceptional level of ignorance and outright delusion in this thread, I'd rather not speculate. Easily 1/3 of the discussion is mired in conspiracy theories about Israel, and another 10 - 20% are people who's comments can be boiled down to "you know, I've never heard of this product/company/industry before, but, by God, the world needs to hear my hot take."

> The founders of CrowdStrike—George Kurtz, Dmitri Alperovitch, and Gregg Marston—do not have publicly documented personal connections to Israel. That's the first claim of yours I faield to verify so I won't bother with the rest.

I realize reading is a very difficult skill to master, but maybe -- just maybe -- you couldn't verify that "claim" because I never made it.

Perhaps I should have been clearer, but especially compared to the rest of the enterprise tech market, security is unusually fragmented. There is no Microsoft or Cisco of the security market in the way those companies dominate the desktop operating system and core networking markets, respectively.

Analysts sometimes refer to the enterprise networking market as "Cisco and the Seven Dwarves". Nobody has ever said that about Symantec (prior to the Broadcom acquisition) or Palo Alto Networks.

It is often the case that in a new security product category, the products are so different, it is hard to collect them together in a single category with a straight face. Example: next generation AV circa 2015-2016. AV was a well-worn product category. All of the legacy products did basically the same thing. More or less at the same time, a bunch of new products came to market that all claimed the mantle of "next generation AV:"

* Bit9 did process whitelisting, later adding Carbon Black for endpoint forensics

* Fire Eye had a proto-EDR solution

* Cylance did ML-based malware detection

* Palo Alto Networks had an exploit-mitigation focused agent that they bolted ML-based malware detection onto.

The industry slowly converged on EDR as the sort-of successor to endpoint AV budgets.

A few years later, the cloud security space was the same fragmented mess. Some were what we now know as CSPM, some were glorified DLP solutions, some container security solutions, etc.