Do you have a source on this? This is quite an accusation, doubling down on it must indicate some certitude...

It’s just absolutely true in my experience. Special agents that gave talks to us in grad school, FBI directors that spoke at security conferences I’ve been to, the people I grew up with that went into security - all morons! The professor I had that was into security and invited some of these people was relatively legit, but literally zero people I’ve met in industry are. One of my heuristics is people that use the word “cybersecurity” don’t know what they’re talking about.

So just to be clear... you listed your personal biases from various experiences that were not security audits as a response to essentially: have you got a source for audits being just nessus scans? For the record, as a person both involved in running security reviews of webapps, and dealing with good and bad companies doing the same, I'm kind of annoyed / disappointed how many people here can't handle nuance or understanding things in context.

This is frustrating to read. The parent is telling the truth, I can’t give you my internal audits because they’re extremely confidential and sometimes a little bit shameful.

It also would affect business relationships which is something every employment contract I’ve ever signed has stated is something which is a violation of my employment terms.

So, to pile on a little: yes, the parent is right in a lot of cases, there are exceptions, but of 12 audits maybe 10 were essentially Nessus version checks. This was needed mostly for rubber stamping.

I'm not disagreeing with you. There's lots of companies doing crap work and lots of companies that need only the compliance checkmark and hope for crap work with no hard-to-fix findings. It's sad, but that wasn't even my issue. I think it's an issue when people start the expectations from the other side: if you had a security audit, it was just a rubber stamp. It's unfair to people who may have invested time and money in a engagement. It doesn't help people who want to run a good audit and hear that it doesn't exist.

Better ways to say the same thing without undermining people's trust in the whole idea: There are lots of scammy security audit companies, Confluence should make sure to engage a good quality ones. Companies should invest in serious pen tests rather than just org compliance for security. Here are companies that actually did a good job...

Unless the goal is to bury the whole idea under a list of issues with bad actors and make sure nobody knows there are alternatives?

This is both hilarious and alarming

I used to let people like that scare me away from using the term “cybersecurity” professionally, and I used to be a bit of a curmudgeon about the term myself.

But when that line of work started putting food on the table, it really softened the ground. “Cybersecurity” is something people understand better than “infosec,” and a part of being a professional is being able to communicate about your work in relatable terms.

So I stopped worrying about those people. I came to discover few of them knew their way around my field, so I stopped being insulted by them. They didn’t know what they were talking about.