We’re all crash test dummies

Often, controls are implemented only after an incident occurs, prompting the reaction, ""I knew that was going to happen."" Whether due to business economics, prioritisation, or apathy, proactive prevention is often overlooked. Most security controls are inconvenient, making tasks harder, slower, or more complex. However, after a disaster, it becomes easier to prioritise, secure funding, and accept new, more complex measures.

Consider airline security. Decades ago, domestic flights had minimal security. Today, we accept stringent controls like x-rays and baggage checks due to past airline disasters. Similarly, the auto industry has seen significant safety improvements following major incidents. Seat belts, airbags, and crash tests became standard after numerous accidents highlighted their necessity.

In cybersecurity, we haven't seen a single catastrophic event that halted the world and demanded greater protection. Similarly, in cyber safety, many foresee potential disasters but fail to take a proactive stance.

This presentation will highlight the importance of shifting from reactive to proactive measures in cybersecurity, drawing parallels with other industries to emphasise the need for foresight and prevention.