The problem is always the same: to do things right, you need people who know what they are doing. Redundantly. Yet, most of us don't know what we are doing, so in practice we end up creating proxies for "the people who know what they are doing according to their certificates certify that I know what I'm doing". Because otherwise you wouldn't be accepted in a cool position, and we all want to be in a cool position. And that's how we end up with so much shit overflowing in the world, but people still pretend they have their own under control. Feeling greedy? Play pretend. A few hours later... Want to be accepted? Play pretend. A few hours later... Want to not be left out? Play pretend.

Except that there are real attacks and the insurance companies affects will do postmortems to figure out why what they demanded didn't work. It will be a few rounds before they figure out how to train for this though. More than a few rounds because the bad guys are not stupid and thinking up new things that smart good people need to mitigate.

One thing I'm a bit pessimistic is that insurance policies usually bring a lot of paper work and eventually it's just certificates over certificates. But again, maybe (a big maybe) this is still better than what things are going on right now.

The best solution is for board members to have respect to their best techincal people and let them create processes best for individual companies. Sadly this is too personal and usually dies when a couple of people jump ship.

Damn, management is so hard.

Hopefully that make those certificates worthwhile someday. Right now they have earned a bad reputation, but with the right training behind it things could change.