4 MIN READ
Most security advice reads as if it were written for someone who is not you, and the reason it feels unhelpful is that it is unhelpful for your specific situation. The advice targets the median enterprise, the median small business, the median home user, the median developer, and the median is nobody. The guidance that is right for the median is wrong for the outliers, and most of the people actually reading the guidance are the outliers. The gap between the standard advice and the actual situation runs as where the confusion lives, and the gap is bigger than the industry likes to admit.
Take the standard guidance to enable multi factor authentication. The guidance is correct, and it sits as the single most effective security control most organisations have ever deployed. It is also useless to the person whose MFA gets bypassed by an attacker who called the carrier and did a SIM swap. Useless to the person whose MFA becomes the push notification they tap without reading because they get thirty of them a day. Useless to the person whose MFA sits on a phone that is six years old and does not get security updates. The guidance is right in the median case and wrong in the specific case, and the specific case amounts to the case that matters.
What your threat model actually is
A threat model amounts to the answer to three questions, and most people skip straight past them to the controls list. What is the thing that has to stay safe. The data, the systems, the access, the money, the reputation, the thing the standard guidance never asks the reader to enumerate. Who or what is trying to take it. The criminal, the insider, the hacktivist, the nation state, the accident, the natural disaster, the threat that has very different defences depending on which threat the operator actually faces. How much friction is acceptable to defend it. The convenience, the cost, the trade off the standard guidance assumes the operator is willing to make in one direction, and the trade off looks very different when it sits as the operator’s trade off to make. None of those three questions get answered by a checklist. None of them get answered by a vendor pitch. All of them get answered by sitting down and writing the answer down before reading another list.
Why the standard advice still gets taught
The median advice sits as the right answer for the median case, which is most of the cases, which is enough to justify teaching it to most of the people, most of the time. The specific advice is hard to write, and the long tail of threat models the long tail of advice would need to address does not fit on a blog post. The long tail needs an actual conversation between an advisor and the person being advised, and the long tail does not scale into a content calendar. The marketing is easier, and the checklist the vendor can put on the website, the ten steps the user can scan in ninety seconds, the simplification the user has been demanding, the simplification the security industry has been providing because the simplification sells. None of those three reasons justify teaching the median advice to the outlier, and none of those three reasons get exposed until the outlier has the incident.
How to find the advice that is right for you
Three moves if the standard advice has not been quite fitting. Skip the headline. The headline amounts to the clickbait, the ten steps, the five rules, the headline that promises to solve the problem in ninety seconds, the headline that almost never applies to the specific case the reader is in. Read the threat model section. The threat model runs as the part the writer almost always skips, the part the writer assumes is obvious, the part the reader has to read carefully to figure out whether the writer is writing for the reader or for someone else. Talk to a person that has the specific situation. The conversation with the person who has been through the same stack, the same budget, the same constraints, the conversation the reader cannot get from the blog post. The reader who does those three moves finds the advice that fits. The reader who follows the headline ends up implementing the wrong defence for the wrong threat and feeling busy about it.
The bottom line
Skip the headline, read the threat model, talk to a peer. The defence that actually fits a specific situation comes from a specific conversation, and the gap between the standard checklist and the real environment is where resilience is won or lost.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
