Dan Luu

2/ This situation forces ORGs to fill InfoSec roles w/ non-security people, we all see this, and these organizations haven't much choice.

3/ It's not helpful for the community to say, 'fire the security team.' It's impossible for them to upgrade the staff.

@jeremiahg That's untrue. It is possible for them to upgrade the staff, they'd just have to open the pocket book.

@dhw It’s been extremely difficult for start-ups and middle america blue chips to compete for talent against silicon valley.

@jeremiahg Both can, they choose not to. Significant equity for startups, significant cash for blue-chips. They don't want to pay.

@dhw As an example, reportedly CISO are now commanding $500K - $1M+ now. ORGs are paying, just aint enough people to go round.

@jeremiahg Paying a lot for a C-level does not translate into necessarily paying a lot for the actual line specialists you need.

@dhw I’ve seen $200K+ there. I’m telling ya, there just ain’t enough people… no matter high much they’re willing to pay.