Five years ago, Thomas Dullien (aka Halvar Flake) presented a keynote at Blackhat Asia that grabbed me like no other. His talk, titled “Why We Are Not Building a Defendable Internet” explored the economics and incentive structures in IT security: Who is incentivised by who to do what - and how these incentives fail to produce the security level we desire.Five years in Internet years is a long time, so what has changed for the better or worse? Are we one step further to creating a defendable Internet, or are we seeing a rapid move to data localisation and fragmentation where sovereign networks appeal to the 1%, as in if you can afford security you get a fancy walled garden? If you can’t, you need to put up with the weeds and rubbish.Does good security mean a lock-in approach or are we actually capable of building an open, transparent and yet secure Internet for all to enjoy?This talk looks back at where we’ve come from and more importantly where we need to go in order to make a defendable Internet a reality.