Navigating a Market for Lemons - by Omer Singer
Bruce Schneier is a genuine cybersecurity legend. The author of Applied Cryptography, inventor of the term “security theater,” and long-time blogger wrote a short piece about USB sticks in 2007. I was reminded of this post while walking down the aisles at this year’s RSA conference. Schneier’s “A Security Market for Lemons” proves, with references to Noble Prize-winning research, that in cybersecurity, it’s not the best product that beats the competition. The nature of our industry is such that weak solutions routinely get purchased over stronger alternatives. This unfortunate dynamic dominates the SIEM space, where buyers rarely measure and compare threat detection performance—even for one of the largest items in their budget. That needs to change for the sake of the industry and everyone’s security posture. Subscribed In his post on the “market for lemons” phenomenon, Schneier asks, “Why are there so many bad security products out there?” That question is as relevant today as ever. T
Navigating a Market for Lemons The case for testing SIEM threat detection performance Omer Singer May 14, 2024 4 2 Share Bruce Schneier is a genuine cybersecurity legend. The author of Applied Cryptography , inventor of the term “security theater,” and long-time blogger wrote a short piece about USB sticks in 2007. I was reminded of this post while walking down the aisles at this year’s RSA conference. Schneier’s “ A Security Market for Lemons ” proves, with references to Noble Prize-winning research, that in cybersecurity, it’s not the best product that beats the competition. The nature of ou
Explore this link on the map →related reading
- Reducing SIEM Alert Fatigue in 2026: How Tuning Improves Detection (Even with AI)redlegg.com
- The Market for Lemons - Wikipediaen.wikipedia.org
- Why Detection Rules Fail: Causes, Effects, and Corrective Actionspicussecurity.com
- Mediumblog.snapattack.com
- You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks | USENIXusenix.org
- The Two-Headed SIEM Monster - by Omer Singeromeronsecurity.com
- Risk-Based Alerting: The New Frontier for SIEM | Splunksplunk.com
- Tuning YARA-L Rules in Chronicle SIEM | by Chris Martin (@thatsiemguy) | Mediummedium.com
- Is the SIEM dead? - CPO Magazinecpomagazine.com
- Themes from Real World Crypto 2022 - The Trail of Bits Blogblog.trailofbits.com
- No Vendor Consolidation In The SOC - by SACRsoftwareanalyst.substack.com
- Protect your organization as SIEM vendor, technology and threat landscape changeslinkedin.com