THE SECURITY BRUTALIST

Security Brutalism Presentations

I recently introduced the Security Brutalism approach to a larger audience. The presentations I prepared, as you'd assume, were done in a very Brutalist style. Here are the slides I used. To provide context, I'll also include some of the key talking points I used during the presentation.

Contents

Presentation 1: The Brutalist Security Way
Presentation 2: 3-Year Security Brutalism Plan
Security Brutalism 3-Year Implementation - Booklet
Security Brutalism Runbook

Presentation 1: The Brutalist Security Way

Today I want to talk about something most security programs are afraid to admit:
That we’ve lost our footing.

In a sea of dashboards, compliance rituals, and frameworks...
We’ve forgotten the mission.
Security isn’t a control set.
It isn’t a program.
Security is war.
Not metaphorically. Not figuratively.
War.
We face real adversaries, with real objectives, who are faster and leaner.
And often better funded than we are.
And how do we respond?
With quarterly audits.
With policy binders.
With tools nobody uses.
That’s not warfighting.
That’s theater.
Brutalist Security throws that away.
It’s not pretty. It’s not polished.
But it works.
It's a way to fight back.
The right way.

Brutalism starts with this: Doctrine. Not decoration.
Everything in your program must trace back to a principle.
Does this reduce risk?
Does this accelerate response?
If not, burn it.
You don’t need 400 controls. You need 12 that matter.
You don’t need perfect coverage. You need speed and clarity.
Stop buying complexity to impress auditors.
Start building muscle to survive chaos.

Brutalist security is built on three things:
Small teams. Fast tempo. Aggressive defense.
You don’t need more people — you need more authority.
Train your team like they’re a special operations team.
Drill incident response until it’s muscle memory.
Stress inoculation is your friend.
And when the breach comes?
You don’t wait for permission.
You move.
We don’t defend by hiding.
We defend by attacking the problem faster than the attacker can move.

Most security leaders I know — myself included —
Have dreamed of a clean, well-architected, risk-mapped enterprise.
Let it go.
The terrain is messy, and it always will be.
You’ve got legacy systems, Third-party junk,
Shadow IT,
And a thousand political constraints.
So what?
Brutalist Security doesn’t whine about it.
It adapts to it.
The faster you stop fantasizing about perfect security,
The sooner you can build real security.

There is no such thing as a perfectly secure environment.
Your goal is not to prevent all breaches.
That’s a lie.
Your goal is to survive them.
To detect fast,
Respond hard,
And recover stronger.
You build that capability not through rigid structure —
But through discipline, training, and grit. Chaos is coming.
You don’t have to be unbreakable.
You just have to bend better than the attacker can break.

This is Security Brutalism:
Hard. Fast. Real.
No buzzwords.
No performance.
Just security that can take a hit — and hit back harder.
Don’t build a program that looks secure.
Build one that survives the fight.
If this resonates with you — tear down what’s an act.
Audit for fluff.
Empower your team.
And above all,
Fight like it matters.

Presentation 2: 3-Year Security Brutalism Plan

Note: Attendees were given a booklet for this presentation, which I've included as text below the slide deck, and you can also download as a PDF.

Let's jump on it. We're going to outline the program.
How we will implement Security Brutalism.
An approach for a stronger, simpler, and more cost-effective defense.
A 3-year plan to transform our security strategy.
And go back to common sense.

Year 1 is about understanding where we are and setting the stage.
We'll assess our current security, define our Brutalism principles,
And run a pilot project.
First, a thorough security audit to identify weaknesses and complexity.
We'll analyze tools, processes, and risks to find quick wins.
Then, we'll define our Security Brutalism policy and standards.
A working group will guide implementation and ensure alignment.

Year 2 is about rolling out Brutalism across the organization.
We'll prioritize systems based on risk and business impact.
We decide which systems/processes get the Brutalist treatment first (based on risk).
We begin to apply the principles across more of the organization.
We pause and check if it's working as expected.
Loop as needed here, it is important!
Adjust the Security Brutalism guidelines based on experience.
Not all orgs are the same. You ahve to adapt and keep on adapting.
Keep people informed. Transparency and communication are key.

Year 3 focuses on making Security Brutalism a long-term success.
We'll optimize processes, automate where possible, and track our progress.
We'll fine-tune the Brutalist Security measures already in place to make them even better.
Use technology to handle repetitive security tasks, making things more efficient.
Use Brutalist Metrics to see how well the Security Brutalism approach is working.
Keep looking for ways to make the security posture stronger
And more aligned with Security Brutalism.
And we'll reinforce the culture.
We'll make security a natural part of how everyone in the organization thinks and acts.

This approach will make us more secure, more resilient, and more efficient.
Security Brutalism is not just a strategy, it's a commitment to a stronger future.

Security Brutalism 3-Year Implementation - Booklet

This plan outlines a 3-year strategy for implementing Security Brutalism principles within an organization. It provides a roadmap for gradually transitioning from a potentially complex and costly security approach to a more streamlined, resilient, and efficient one.

Vision: To establish a security posture that is robust, resilient, and cost-effective, aligned with the principles of Security Brutalism, and that effectively protects the organization's assets while enabling business objectives.

Please note that the timelines presented are based on an ideal scenario. To make them realistic for your specific context, you'll need to adjust them based on factors such as your organization's size, the dedicated team resources, and the level of leadership support for this program.

Guiding Principles:

Year 1: Assessment and Foundation

Phase 1: Security Assessment and Gap Analysis (3 Months)

Phase 2: Establish Brutalism Principles and Governance (3 Months)

Phase 3: Pilot Project Implementation (6 Months)

Year 2: Broadening Implementation

Phase 4: Expand Brutalism Implementation (12 Months)

Year 3: Optimization and Refinement

Phase 5: Optimize and Mature (12 Months)

Security Brutalism Runbook

This runbook provides detailed, step-by-step instructions for implementing specific Security Brutalism principles within the organization. It is a living document that will be updated and expanded as the implementation progresses.

Core Principle: Simplicity

Example:
System: Vulnerability Management
Complexity Driver: Using three different scanning tools with overlapping functionality.
Solution: Consolidate to a single, comprehensive vulnerability management platform, and automate scanning and reporting.

Core Principle: Resilience

Example:
System: Authentication System
Resilience Measures: Implement a redundant authentication server setup with automatic failover, and use multi-factor authentication (MFA) to reduce the impact of compromised credentials.

Core Principle: Transparency

Example:
System: Firewall Rules
Transparency Improvements: Document each firewall rule with a clear description of its purpose, the systems it applies to, and the justification for its existence. Use a centralized firewall management system with audit trails.

Core Principle: Functionality

Example:
Threat: Phishing Attacks
Functional Security Measure: Implement a multi-layered approach that includes employee training and awareness programs focused on recognizing phishing emails, email filtering to block known phishing attempts, and technical controls to prevent users from clicking on malicious links or downloading malicious attachments.

Core Principle: Efficiency

Example:
Inefficient Process: Manually reviewing firewall logs.
Efficiency Improvement: Implement a SIEM system to automate log analysis and alert on suspicious activity.

Core Principle: Defense in Depth (Simplicity Focused)

Ecample:
Asset: Customer Database
Security Layers: Perimeter Security: A simple, well-configured firewall with only essential ports open. Network Security: Network segmentation to isolate the database server, and intrusion detection/prevention. Host Security: A hardened operating system with only necessary services running, and host-based intrusion detection. Application Security: Secure coding practices, input validation, and output sanitization in the database application. Data Security: Encryption of the database at rest and in transit, and strict access controls.

Closing

This 3-year plan and runbook provide a comprehensive framework for implementing Security Brutalism. Remember that this is an iterative process, and the plan and runbook should be regularly reviewed and updated as needed.