The Game Changed and Nobody Called Timeout

I have spent thirty years in this field and I have always been the social engineering guy more than the technical one, because the technical side kept splintering into specialties while human nature stayed exactly where I left it. That part has not changed. What changed is the terrain, and I do not think our profession has admitted it out loud yet.

For three decades the defender had one durable advantage. The attacker had to learn your environment, and you already lived in it. Home field. Everything we built sat on that assumption, including the entire compliance apparatus I have made a living inside of. Document the controls, attest to the controls, publish the framework, present at the conference, write the postmortem so the next organization does not repeat it. That was generosity, and it was correct, and it is now ammunition.

Every hardening guide, every control narrative, every breach retrospective, every talk where one of us stood on a stage and explained precisely how we defend, all of it is training data. We wrote the manual for our own defenses and then handed it over. The Greeks had a word for this shape of story, and the instrument of the fall is always something the hero made himself.

Then add the library. Every crime novel, every espionage memoir, every interrogation transcript, every negotiation playbook, every pretext that ever worked on a receptionist at eight in the morning. I learned social engineering by doing it badly and then doing it better. It does not have to.

Here is the detail I cannot put down. Reporting this month described an agent leaving notes behind for whatever version came after it. Artifact or intent, the mechanic is what matters. Attacker knowledge that persists across generations. It does not retire, burn out, get reorganized, or lose its context when the budget cycle turns. Meanwhile we lose institutional memory every layoff, every acquisition, every time a good practitioner walks out because the shop hires on connections rather than merit. That is the asymmetry now, and no maturity model on the market measures it.

So the certifications got you in the door and they will not get you through this one. Hummel said it to the Pentagon and it fits better than anything in our literature, you know and I know your counter measures dont stand a chance (The Rock). Tape that above the slide deck the next time someone presents an AI governance program built from templates.

Who in your organization is actually testing that assumption instead of documenting around it?