Niels Provos: detection can't be perfect, and most firms can't afford a security program

Niels Provos co-authored the bcrypt password hash and spent 15 years at Google. On GitHub's podcast he made two linked points. Detection can never be perfect. And most companies, he said, cannot even afford a security program.

What was said

Provos said that "so much of the security industry is about the, we will detect bad things, and you can't detect perfectly." Security operations teams, he said, get many false positive alerts, meaning warnings about harmless events. They spend most of their time on them.

He sees the same trap in open source, where maintainers have very limited time. His answer is a bug-finding workflow in which AI models must write a working exploit. Then a maintainer knows without doubt that the issue is real.

His other answer is design. Provos described Operation Aurora, a breach of Google by attackers tied to China's government, as a wake-up call. He said Google built security invariants into its infrastructure, so that much of the attack surface is gone. He did the same at Stripe, where he was head of security.

Most firms are in a different spot, he said. In his words, "most of them can't even afford a security program." No off-the-shelf product, he added, can make a company secure.

Why it matters

Our reading: a detector sells a bill that never ends. Every alert needs a person, and every missed attack is a breach. Design that removes attack surface works differently.

An invariant is a property the system guarantees by construction, so a whole class of attack cannot happen. Here is our own illustration, not Provos's. A database that accepts no outside connections needs no alarm for outside attempts. There is nothing to watch.

The exploit requirement follows the same logic. It filters out false alarms before a human sees them.

The cost question follows from this, and Provos did not put it this way. Firms that cannot afford design work may stay on the endless bill. Their users and customers carry the risk when detection misses.

Three questions for a security lead or vendor. Which attacks are impossible in our systems by design, not just watched for? How many alerts did we handle last quarter, and how many were real? When you report a flaw, do you prove it?

The other side

Provos spoke of a security program in general. He did not say design work is what small firms cannot afford. He gave no figures for what it costs, or how a small firm could do it on a small budget.

He did not call detection useless. His claim was narrower: it cannot be perfect. He also described his exploit workflow as work in progress, with no results given in this part of the talk.

Google and Stripe are two firms with deep security experience. Provos did not explain in detail what they built. Who pays for the harder path at a small company was left open.