With the security “industry” well into its second decade, we have a highly evolved enemy. This enemy has neither a face nor a voice, neither a dossier nor a tangible background; it doesn’t even have a name. The only way we know it exists is by measuring our progress, or lack thereof. The new enemy is complacency. In the fifth edition, we spoke about the new enemy being vigilance. But what underlies this lack of vigilance is complacency. We have become complacent—just as we did before September 11th, 2001. As Spock would say, “Humans are fascinating.” We only react. We do not pro-act. We do not prevent until something happens. And then it’s too late. Far too late.

The security industry and the professionals who mark its boundaries have already been fighting the enemies at the gate and the enemies behind them (the executives and managers who don’t understand the risk their organization is taking on when they are lackadaisical about security). But now we must deal with the complacency that comes from “nothing happening.” Remember that good security is measured by “nothing happening.” But what happens to the human psyche when “nothing happens”? We believe we are invincible. That nothing can happen to us. We forget our vulnerability and frailty. We forget that “bad stuff” can happen. Until the next catastrophe… So how do we deal with this morass? In our travels, there is only one other way to get security the attention it requires, only one way to get the “light bulbs to go off”: show them. And that’s where we come in. Take this book as your guide, as your recipe for attention. Take this to anyone who will listen or anyone who will watch your screen for ten seconds, and show them (on test systems, of course) what can happen in an instant when a bad guy or gal, with the motivation and opportunity to do bad things, turns his or her attention your way. Then watch the light bulbs go off…