"What we are seeing now is customers shifting their attention from security products like firewalls and intrusion sensors, to the policies that need to be in place, and the technologies that help them enforce policy compliance"
About this Quote
A firewall used to be the corporate moat: visible, purchasable, reassuring. John W. Thompson is pointing at the moment that story stopped working. His intent is managerial and strategic at once: stop fetishizing gadgets and start treating security as governance. In executive English, that’s a budget argument and a cultural argument. Buy fewer shiny boxes, invest in rules, accountability, and the machinery that makes rules real.
The subtext is a quiet admission that perimeter security is losing its grip. When “customers” pivot from products to policies, they’re conceding that threats don’t politely arrive at the network edge anymore; they ride in through laptops, vendors, cloud apps, and human error. Thompson frames this as progress - attention “shifting” toward maturity - but it also signals fatigue with the old security theater: tools that create dashboards, not safety.
Context matters: Thompson’s career spans IBM’s enterprise era through the rise of cloud and compliance-heavy industries. His language is the language of enterprise procurement, where risk becomes a line item and “policy compliance” becomes the measurable proxy for trust. Notice the phrasing: not policies alone, but “technologies that help them enforce” them. That’s a nod to the real constraint in big organizations: people don’t follow rules because rules exist; they follow them when systems make deviation difficult, auditable, and costly.
It works because it recasts security from a heroic, reactive posture (“stop intrusions”) to a bureaucratic one (“reduce variance”). Less cinematic, more effective - and, for businesses, more defensible when something inevitably goes wrong.
The subtext is a quiet admission that perimeter security is losing its grip. When “customers” pivot from products to policies, they’re conceding that threats don’t politely arrive at the network edge anymore; they ride in through laptops, vendors, cloud apps, and human error. Thompson frames this as progress - attention “shifting” toward maturity - but it also signals fatigue with the old security theater: tools that create dashboards, not safety.
Context matters: Thompson’s career spans IBM’s enterprise era through the rise of cloud and compliance-heavy industries. His language is the language of enterprise procurement, where risk becomes a line item and “policy compliance” becomes the measurable proxy for trust. Notice the phrasing: not policies alone, but “technologies that help them enforce” them. That’s a nod to the real constraint in big organizations: people don’t follow rules because rules exist; they follow them when systems make deviation difficult, auditable, and costly.
It works because it recasts security from a heroic, reactive posture (“stop intrusions”) to a bureaucratic one (“reduce variance”). Less cinematic, more effective - and, for businesses, more defensible when something inevitably goes wrong.
Quote Details
| Topic | Privacy & Cybersecurity |
|---|
More Quotes by John
Add to List
