Cybersecurity companies spend considerable time and money developing proprietary tools, techniques and expertise. Those capabilities can distinguish one firm from another, justify premium consulting fees and provide a competitive edge.
But what happens when protecting that competitive advantage gets in the way of protecting customers?
Kevin Tackett, founder of Secure Ideas, believes too many cybersecurity professionals have lost sight of the industry's fundamental purpose. In a recent episode of CYBR.HAK.CAST with hosts Michael Farnum and Phillip Wylie, Tackett challenged the notion that security expertise should be guarded like a trade secret.
His argument is simple: If you're doing something that could help others become more secure, you should be willing to share it.
"We don't have a secret sauce," Tackett said of Secure Ideas. "And we don't have a secret sauce because we publish and share everything we do, as we should."
It's a philosophy that raises uncomfortable questions about how the cybersecurity industry measures success, particularly when commercial interests collide with the needs of defenders.
Full episode and related article:
, and CYBR.SEC.Media
Bill Brenner
When protecting an exploit matters more than protecting the customer
Tackett illustrated the problem with a disagreement he had during another podcast appearance.
The discussion centered on red-team engagements in which security professionals develop exploits to bypass endpoint protection or other defensive controls. These capabilities can require substantial time and expertise to build, making them valuable assets for the consulting firms that develop them.
But Tackett believes those firms have an obligation to provide the resulting exploits to their customers so they can reproduce the attacks, test their defenses and determine whether remediation efforts actually work.
The other podcast host disagreed, arguing that giving an exploit to a customer risks having it uploaded to VirusTotal or otherwise exposed. Once defenders and security vendors recognize the technique, the exploit may lose its effectiveness in future engagements.
Tackett wasn't persuaded.
"Is the goal to show how cool you are that you hack stuff? Or is the goal to help the customer be better?" he asked.
That distinction gets to the heart of the issue.
A red-team engagement isn't supposed to be a demonstration of how clever the attackers are. Its purpose is to expose weaknesses that an organization can understand, address and ultimately defend against.
If a consulting firm develops an effective exploit but withholds the means to reproduce it, the customer may know a weakness exists without having everything needed to validate the fix.
The consulting firm preserves a valuable capability. The customer potentially loses an opportunity to improve its defenses.
Tackett sees that as a failure of priorities.
"The goal is not to be cool. The goal is to move the needle."
The problem with cybersecurity's secret sauce
The exploit-sharing debate reflects a larger tension within the security industry.
Consultancies compete on expertise. Vendors compete on technology. Researchers build reputations around discoveries and techniques that others haven't yet mastered.
There are legitimate reasons to protect intellectual property and carefully manage the disclosure of vulnerabilities. Releasing an exploit without considering the consequences can expose organizations to additional risk.
But Tackett's argument challenges the assumption that knowledge becomes less valuable when more people possess it.
In fact, he believes the opposite.
Sharing techniques invites scrutiny, feedback and improvements that might never emerge when research remains confined to one organization.
When a practitioner publishes a method, someone else may identify a better approach. When a researcher releases a tool, other developers may extend its capabilities. When an experienced professional explains how something works, someone entering the field gains knowledge they can build upon.
"We should always be sharing stuff. We should always be teaching other people," Tackett said.
He argues that this exchange makes both sides better.
The implication is that cybersecurity's culture of collaboration isn't merely a charitable exercise. It's a practical way to improve the quality of the industry's collective defenses.
Open source shows what collaboration can accomplish
Tackett pointed to OWASP Amass, an open-source attack surface mapping and asset discovery tool originally developed by Jeff Foley, as an example of what happens when security professionals share their work.
Foley could have pursued a commercial product, Tackett observed. Instead, he made the tool freely available.
Other contributors subsequently expanded and improved it.
"It's better than he could have made it himself because of contributions by other people," Tackett said.
That example illustrates a fundamental advantage of open-source security development: A tool doesn't have to remain limited by the time, resources or perspective of its original creator.
Researchers can identify shortcomings. Developers can add capabilities. Practitioners can adapt the software to emerging needs.
The benefits extend beyond the tool itself. People who examine and contribute to open-source projects gain technical experience, while the wider security community gains access to capabilities that might otherwise remain commercially restricted.
For Tackett, that's how cybersecurity should work.
Sharing knowledge doesn't mean abandoning the business
Of course, cybersecurity companies still have employees to pay, customers to serve and businesses to sustain.
Tackett acknowledges that reality. Secure Ideas has grown to roughly 30 employees since he founded the company more than 16 years ago.
He jokes about being responsible for 30 people's mortgages and their unreasonable expectation of receiving regular paychecks and benefits.
His point isn't that security professionals should work for free or that companies shouldn't profit from their expertise.
It's that making money shouldn't become the industry's overriding objective.
A consulting company can charge for the experience, judgment and work required to assess an organization's security while still sharing the underlying knowledge that helps others improve.
Likewise, an organization can publish research and tools without surrendering the value of its people or the services they provide.
Tackett believes the business should support the mission rather than define it.
That distinction is particularly important in an industry where organizations regularly talk about community, collaboration and collective defense while simultaneously competing for customers, talent and intellectual property.
The question is whether those commitments hold up when sharing something valuable carries a commercial cost.
We are the shoulders others stand upon
Tackett's philosophy comes from his own experience.
He began working with bulletin board systems as a teenager, moved through software development and systems administration, and eventually built a career in penetration testing, consulting and cybersecurity education.
Along the way, he benefited from the tools, training and expertise that others made available.
He believes that creates an obligation.
"We stand on the shoulders of giants," Tackett said, invoking the familiar expression about building on the achievements of those who came before us.
But he believes the saying is incomplete.
"We are the shoulders others stand upon."
It's a powerful way to frame cybersecurity's responsibility to the next generation of practitioners.
Today's researchers learned from someone. Today's penetration testers use tools someone else developed. Today's defenders rely on techniques and discoveries that others chose to share.
The industry's progress depends on that cycle continuing.
And Tackett believes the responsibility extends beyond mentorship or publishing the occasional open-source project. It should influence how security professionals conduct engagements, develop tools, educate customers and measure their own success.
That doesn't eliminate the need for responsible disclosure, careful handling of offensive capabilities or sustainable business models.
It does demand a clearer answer to a basic question: Who is the work ultimately supposed to benefit?
For Tackett, the answer isn't the consultant who gets to reuse an exploit or the company that gets to protect its secret sauce.
It's the customer, the community and the people who will build on what today's security professionals leave behind.
The industry likes to talk about moving the needle.
Tackett's challenge is to stop treating knowledge as something to hoard and start treating it as something that can move the needle for everyone.
