Navigating a Market for Lemons - by Omer Singer
Bruce Schneier is a genuine cybersecurity legend. The author of Applied Cryptography, inventor of the term “security theater,” and long-time blogger wrote a short piece about USB sticks in 2007. I was reminded of this post while walking down the aisles at this year’s RSA conference. Schneier’s “A Security Market for Lemons” proves, with references to Noble Prize-winning research, that in cybersecurity, it’s not the best product that beats the competition. The nature of our industry is such that weak solutions routinely get purchased over stronger alternatives. This unfortunate dynamic dominates the SIEM space, where buyers rarely measure and compare threat detection performance—even for one of the largest items in their budget. That needs to change for the sake of the industry and everyone’s security posture. Subscribed In his post on the “market for lemons” phenomenon, Schneier asks, “Why are there so many bad security products out there?” That question is as relevant today as ever. T
Navigating a Market for Lemons The case for testing SIEM threat detection performance Omer Singer May 14, 2024 4 2 Share Bruce Schneier is a genuine cybersecurity legend. The author of Applied Cryptography , inventor of the term “security theater,” and long-time blogger wrote a short piece about USB sticks in 2007. I was reminded of this post while walking down the aisles at this year’s RSA conference. Schneier’s “ A Security Market for Lemons ” proves, with references to Noble Prize-winning research, that in cybersecurity, it’s not the best product that beats the competition. The nature of ou
related reading
- Reducing SIEM Alert Fatigue in 2026: How Tuning Improves Detection (Even with AI)redlegg.com
- Is this the end of SIEM?franklyspeaking.substack.com
- Why Detection Rules Fail: Causes, Effects, and Corrective Actionspicussecurity.com
- Risk-Based Alerting: The New Frontier for SIEM | Splunksplunk.com
- Tuning YARA-L Rules in Chronicle SIEM | by Chris Martin (@thatsiemguy) | Mediummedium.com
- Mediumblog.snapattack.com
- You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks | USENIXusenix.org
- Themes from Real World Crypto 2022 - The Trail of Bits Blogblog.trailofbits.com
- The Two-Headed SIEM Monster - by Omer Singeromeronsecurity.com
- Is the SIEM dead? - CPO Magazinecpomagazine.com
- Today, You Really Want a SaaS SIEM!medium.com
- No Vendor Consolidation In The SOC - by SACRsoftwareanalyst.substack.com