Infosec has managed to squeeze itself into a very oddly shaped niche. We use boxes and blinky lights wrapped in the promise of being able to prevent packets of malicious intent from harming a human hell bent on shooting themselves in the foot. We've built careers around promising a boogie man under every bed, an entire branch of some foreign military dedicated to stealing your intellectual property and faceless online gangs itching to burn your company to the ground just to see the flames. All of that would be fine, had it worked. But here we are, instead, with 30 years of the industry behind us and a threat landscape that vastly exceeds any of our current, or promised, capabilities. It's time we changed from tactics to strategy. It's time we apologized to all of the users and companies that we serve and it's time to look at infosec as a survival skill instead of a cost center.