Back to overview

Why Cybersecurity Is Broken and Time Is the Enemy

WRITTEN BY
iCOUNTER
DATE
March 9, 2026
Why Cybersecurity Is Broken and Time Is the EnemyWhy Cybersecurity Is Broken and Time Is the Enemy
Copy to Clipboard
Share
Copy to Clipboard

Why do your friends and parents still get breach notification letters from companies they’ve never heard of?
‍

John Watters aka “The Cowboy” joins the show this week for a hard look at information security. In the early 2000s, he built iDefense from a bankruptcy buyout into one of the most influential threat intelligence companies in the world, pioneered responsible disclosure before the term even existed, and has watched the attack surface evolve from nation-state espionage into something that hits your credit card at a restaurant on a Tuesday.

‍

His answer to the breach question? The industry's been losing the clock. Attackers can move from target selection to exploitation in days. Defenders are still operating in weeks. And the gap isn't closing, not by a long shot. If anything, it's widening.
‍

This conversation goes from the living rooms of people who've stopped trusting cybersecurity to the boardrooms of Fortune 500 CISOs who still can't explain their third-party risk exposure in plain English. We talk time compression, threat intelligence architecture, the AI arms race that only one side seems to be taking seriously, and the uncomfortable truth about analysis paralysis in a field where the cost of inaction is terminal.
‍

John's closing advice to defenders: automate yourself out of a job before someone else does it for you.
‍

That one's worth the price of admission alone.

‍

01
Do we know our actual ecosystem?
Map vendors, SaaS providers, managed service providers, suppliers, partners, identities, and critical dependencies, including fourth parties where business impact warrants it.
02
Do we understand access, not just vendor names?
Identify which third parties hold credentials, API access, privileged identities, sensitive data, or connectivity into critical systems.
03
Can we identify concentration risk?
Find where multiple critical processes depend on the same providers or upstream services. C-Track is what this looks like unmapped.
04
Are we detecting change between assessments?
A vendor assessed six months ago is a target today. Monitoring has to account for compromise signals, exposed credentials, infrastructure changes, and domain abuse.
05
Can we turn intelligence into action?
Risk intelligence earns its cost when it reaches a team able to act, whether that is the SOC, third-party risk management, procurement, incident response, or the vendor.