The cybersec industry is solving the wrong problem. Here's why I think so.

A few years ago I "somehow" (ask me in the comments if you're curious) ended up in cybersec. I used to be just a "generic" software dev, so honestly I never thought Id be working with people who actually helped shape this industry in its very early days.

One of them is Tomasz Kojm, founder of Contextal and the guy who decades ago originally created ClamAV being still... at university. No funding, no experience, no company behind it, absolutely no support even from university itself. Just another project for him. Working with people like Tomek is a great experience. Not because you work with a cybersec veteran, but because you learn something you can't learn anywhere else. You start to notice more than you did before. You just become smarter within time - whatever that means.

Decades ago when Internet was becoming mainstream, organizations were floooooded with malware. However... nothing was as obvious back then as it may seem today. The biggest challenge wasn't understanding data. It was scale. Imagine processing massive volumes of files and emails manually. Therefore automation became the top priority, and the whole system design had to stay fairly simply: is this email / file malicious? Give me a quick verdict. Yes or No. That's basically it.

Now, according to Gartner, worldwide cybersecurity spending in 2026 is expected to reach almost $240B. And let's be honest.. next year it will probably be $260B, then $280B, then $300B etc. We don't need a crystal ball to predict where this is going. But let's stop here.

We spend hundreds of billions every year on cybersecurity and still lose billions because of cyberatacks. You read about another ransomware attack, stolen credentials and businesses paralyzed or shut down for months.

2026 - Hasbro - $25M in lost revenue

2026 - Marks & Spencer - £300M reduction in operating profit

2025 - Co-op Group - £206M in lost revenue

These are the companies we all know, and which mainstream media like because they convert. But there are thousands of them every year - just different scale and popularity.

So here's the question. If organizations spend more money than ever before, why do we still keep loosing? Companies are literally ARMED: endpoint protection, email security, sandboxes, malware scanners, AI... they seem to have everything. And that's the biggest paradox.

I don't think cybersecurity nowadays has a detection problem anymore. It has a decision problem!

Nowadays, modern data is no longer SIMPLE. Imagine a "simple" PDF can contain embedded objects, scripts, external references, QR codes, even encrypted parts. A single black box verdict often tells you almost nothing. Something that looks malicious doesn't really have to be. Something that looks clean doesn't have to be either. This is where context becomes everything.

Automation isn't the problem. Actually I think it's one of the biggest achievements in this industry. Catching generic threats on the fly is priceless but nowadays... security rarely operates in such ideal conditions. I guess most of you have seen VirusTotal showing 1 engine saying "malicious" while another 60+ classify exactly the same sample as clean. So... who's right? You probably won't open Reddit and ask people to make the decision for you ❌ Ive even had samples where every engine completely missed the malicious content.

When the verdict isn't obvious, and expect it to happen often. You don't need another detection engine in your stack. You don't need another black box verdict. You need evidence. You need context. Imagine, modern data carries metadata, relationships, execution paths, embedded objects and bahavior signals. None of them invididually proces malicious intent, but together they build context. And context is what helps analysts actually make good decisions.

I don't think organizations lose millions because they lacked one more malware verdict. I think they lose millions because they lacked the context needed to make the right decision. We live in a world where nothing is black and white anymore. You need a full picture of your data to understand what's going on and make a good decision.

I published my 1st 🥳 article on my blog. If you would like to dive deeper, feel free. I would be grateful. Btw, I will keep writing more stories in the future. I can't promise when because of work and other stuff, but it's something I really enjoy doing. I'm happy to answer any questions or discuss it in the comments.

https://magicsays.com/the-cybersecurity-industry-is-solving-the-wrong-problem