We spend millions protecting the servers and the data. We do countless threat modeling exercises. We employ armies of red-teamers to prove that our systems are secure from various technological threats. But at the end of the day, have we lost sight of what we are really protecting?

Ultimately, "what" we are protecting boils down to "who" we are protecting. If we've lost sight of the humans who ultimately are utilizing these systems and entrusting our technological ecosystems with their precious data and identities, then it's easy to become cynical as well as Trapped In The Weeds of what is technically possible versus what is sustainable and desirable as outcomes for our Security Programs.

When security has come to be seen as the "Department of No," that's a good sign that we have lost our way and need to chart a better course for keeping our users, developers, and ourselves safe. This means getting past our biases, stopping blaming the user, and getting on the same page as those we need to secure.

This talk is a call to action to get away from our keyboards and get into real conversations with our colleagues that can help us transition away from being bottlenecks to being the solvers for efficiency, and the team that helped make the safe way also the easiest and most sustainable way.