/You are not a regular expression\./
Stop acting like it.
Audience: Professionals that build and reason about secure architecture and distributed systems, that are subject to audit.
There’s a moment in every security audit or design review where someone says “best practice” like it’s a spell that wards off liability. Defense in depth. Zero trust. Principle of least privilege.
We recite the catechism and feel safer for having named the almighty gods.
Hear me out: best practices are just other people’s answers to other people’s problems. They are sanitized to be unfeeling, unthinking, calming, constant. They’re fossils of context you definitely don’t have, facing threats you probably don’t face, under constraints that certainly aren’t yours.
The most dangerous security practitioner, dear attacker-mindset corporate hacker, isn’t the one who knows too little; it’s the one who knows exactly enough to be confident and exactly too little to be humble. They’ve seen this before. They know what works. They have a pattern for this. This fits.
Get asperand’s stories in your inbox
Join Medium for free to get updates from this writer.
Pattern matching is fast. First principles thinking is slower, more deliberate. And in a profession that rewards the appearance of control, fast wins meetings. You can’t put “questioned fundamental assumptions for six hours” on a status report. But you can write “implemented industry standard controls” and everyone nods solemnly. You have done well. You have fulfilled the prophesy. Compliance is safety, we promise.
Here’s what they don’t tell you when you’re grinding through certifications: experiential security maturity truly just isn’t blindly accumulating more patterns. (Leave catching them all to the Pokemon.) It’s developing the judgment to know when patterns fail. It’s the courage to say “none of these fit” and derive something new.
The flexible practitioner starts with different questions. Not “what’s the standard approach?” but “what am I actually trying to prevent?” Not “what does the framework say?” but “given my actual threats, constraints, and context, what’s the simplest sufficient control?”
Sometimes that’s mTLS and hardware security modules. Sometimes it’s a well-placed rate limit and a human who reads logs once in a while. The architecture that protects a nuclear enrichment facility will stop a startup in its tracks. The controls that make sense for PII don’t make sense for public datasets. But we apply the same patterns anyway because they’re familiar, certifiable, and defensible in court.
The certification industrial complex doesn’t want you thinking this way. They sell patterns because patterns scale. You can train a thousand people on NIST frameworks. (This is not a slight on NIST; They play an important role.) You can’t train a thousand people to think from first principles; that’s something you have to learn by being wrong enough times to develop intuition.
An epiphany moment in your personal security-thinking maturity is when you realize that frameworks are training wheels, not immutable guardrails. It’s when you can look at a “critical” finding from an auditor and think: “That’s true in general, but not true here, and I can explain why.” It’s when you stop trying to implement every control and start asking which controls actually reduce your specific risks.
The irony is that first-principles thinking often leads you back to simple, boring solutions. Not because you don’t know the sophisticated patterns, but because you’ve derived that sophistication isn’t what you need. The junior practitioner reaches for complexity to prove competence. The mature practitioner reaches for simplicity because they’ve learned that boring is good.
So the next time someone says “best practice,” ask yourself: best for whom? Under what assumptions? Optimizing for what outcome? If you can’t answer, you’re pattern matching. And pattern matching can be pretty damn expensive… in time, resources, space, …and SaaS license bills.
The superpower isn’t knowing more patterns. It’s learning how to morph them and compose them to fit the needs of the organization.
