The Limits of Human-Centric Cybersecurity

Perimeter-based security has long been the dominant model for defending IT infrastructure: build a strong wall of firewalls, VPNs, and VLANs, and trust everything inside it. That model is breaking down. Social engineering, phishing campaigns, and advanced persistent threat (APT) groups are increasingly successful at exploiting the weakest point in any security system — human judgment.

The COVID-19 pandemic illustrated this risk at scale. As organisations scrambled to enable remote work almost overnight, cybercriminal groups moved quickly to exploit the confusion. The disruption was significant enough that the United States Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC) issued a joint alert warning organisations of malicious actors exploiting pandemic-related uncertainty.

The lesson is clear: defenders cannot rely solely on humans to detect, respond to, and contain every threat in real time. Infrastructure must increasingly be capable of protecting itself.

Cyber as a Domain of Warfare

During his keynote at the 2017 Institute for Critical Infrastructure Technology (ICIT) Winter Summit, General Michael Hayden — former Director of both the NSA and CIA — described cyberspace as an entirely new domain of warfare alongside land, sea, air, and space. He argued that cyber threats should be treated with the same seriousness as invading armies, and that the private sector must take primary responsibility for securing the cyber domain rather than waiting for government action.

“We will have to rely on ourselves and the private sector in a way that we have not relied on ourselves for security.”

— General Michael Hayden, ICIT Winter Summit 2017

That call to action has only grown more urgent. The pace of attacks, their sophistication, and the scale of potential impact on critical infrastructure demand that technology itself take on a more active defensive role.

What “Machines Protecting Themselves” Actually Means

The concept of self-defending machines is not about artificial intelligence autonomously declaring war on attackers. It refers to architectures in which each individual system — server, endpoint, or workload — actively participates in its own defence rather than depending entirely on network-level controls.

David McNeely, Chief Strategy Officer at Centrify, described one practical implementation of this model. The approach embeds a client directly into the operating system that acts as an intermediary, establishing a verified, trusted identity for every machine on the network. That client is then responsible for:

• Authenticating every login attempt and resource request against an authoritative identity service such as Active Directory (AD)
• Enforcing multi-factor authentication (MFA) policies to guard against bots, compromised credentials, or spoofed identities
• Determining whether a login session should be audited and recorded based on defined policy conditions
• Enforcing least-privilege access by granting only the specific privileges each user requires, for only as long as necessary

In McNeely’s words: “The computer account and trust relationship is what enables strong authentication of user login requests. Self-defending machines address the paradigm shift occurring in cybersecurity today where protection cannot be enforced at the network boundary.”

From Network Trust to Zero Trust

Traditional network security assumed that anything inside the corporate perimeter was safe. Administrators defined trusted zones using VLANs, firewalls, and VPNs. Inside those zones, machines were largely trusted by default.

Zero Trust inverts that assumption entirely. No network, device, or user is trusted by default — not even those already inside the perimeter. Every access request must be authenticated, authorised, and validated, regardless of where it originates.

Self-defending machines are a practical implementation of this principle. Rather than relying on the network boundary to determine what is trustworthy, each machine enforces policy locally. It checks identity, validates context, applies MFA, enforces privilege limits, and logs the session — all without depending on whether the network perimeter is intact.

This matters most in distributed environments: multi-cloud deployments, hybrid on-premises and cloud infrastructure, remote workforces, and edge computing. In all of these scenarios, there is no clean perimeter to defend. The machine itself must carry its own armour.

NIST SP 800-207: The Zero Trust Architecture Standard

The National Institute of Standards and Technology (NIST) has formalised the principles of Zero Trust in Special Publication 800-207, Zero Trust Architecture. This document defines a set of tenets and architectural approaches that organisations can use as a framework when designing or evaluating their security posture.

Key tenets from NIST SP 800-207 relevant to self-defending machine architectures include:

• All data sources and computing services are considered resources. Security controls apply to all assets, not just those on a defined internal network.
• All communication is secured regardless of network location. Being on an internal network does not confer implicit trust.
• Access to individual enterprise resources is granted on a per-session basis. Trust is re-evaluated for each access request.
• Access is determined by dynamic policy. Decisions incorporate identity, device health, and behavioural context.
• The enterprise monitors and measures the integrity and security posture of all assets. Continuous monitoring replaces point-in-time validation.

The standard also reinforces the principle that defences should be as close to the protected asset as possible. In a wartime analogy, soldiers carry body armour rather than relying solely on fortress walls. In cybersecurity terms, that means each server and endpoint must be equipped to enforce its own access policies, not delegate all enforcement to a distant network perimeter.

NIST SP 800-207 is a public document available on the NIST website at no cost and without registration.

Identity-Centric Architecture in Practice

Centrify’s approach, as described by McNeely, centres on identity as the primary control plane. Instead of trusting the network to decide who gets access to what, every machine actively verifies identity before granting access. Policy is defined centrally — in Active Directory or a cloud-based Privileged Access Service — and enforced locally by the client embedded in each system.

This identity-centric model delivers several practical security improvements:

• Consistent enforcement across environments: Policies apply whether the machine is in a corporate data centre, a public cloud, or a co-location facility.
• Reduced blast radius: If one machine is compromised, it cannot automatically be used to access others, because lateral movement still requires authenticating against the identity service.
• Auditability: Every privileged session can be captured and reviewed, providing forensic evidence and supporting compliance requirements.
• Least privilege by default: Users and service accounts receive only the access they need, automatically expiring elevated rights when they are no longer required.

Practical Takeaways for DevOps and Platform Engineering Teams

For teams managing infrastructure at scale, the shift toward self-defending machines has concrete implications:

• Treat identity as infrastructure. Privileged Access Management (PAM) and identity verification should be built into your infrastructure-as-code pipelines, not bolted on after deployment.
• Eliminate implicit trust between services. Service-to-service communication should be authenticated and authorised explicitly, using short-lived credentials or mutual TLS, not network segment membership.
• Enforce MFA at the machine level. MFA should protect not just human logins but also administrative access to servers and cloud workloads.
• Automate privilege expiry. Just-in-time (JIT) access grants elevated permissions for a defined window and revokes them automatically, reducing the window of opportunity for attackers.
• Audit everything privileged. Session recording and command logging for privileged access provides both security monitoring capability and audit trail for compliance.

Conclusion

The perimeter is gone. Distributed infrastructure, remote workforces, and sophisticated adversaries have made network-boundary security an insufficient foundation for modern cybersecurity programmes. The response is not simply to add more network controls — it is to push security enforcement down to the asset level, so that every machine is capable of authenticating, authorising, auditing, and defending access to itself.

NIST SP 800-207 provides the architectural framework. Identity-centric platforms that embed policy enforcement directly into operating system clients provide one practical implementation path. The underlying principle — that in an era of distributed, cloud-native infrastructure, every machine must carry its own defences — is sound and increasingly non-negotiable for organisations serious about security.

As General Hayden argued in 2017, and as subsequent years have confirmed: private organisations cannot wait for external forces to secure the cyber domain. The technology to make machines self-defending exists. The standard to guide implementation is published. The question is how quickly teams can adopt and operationalise both.

Ask Yourself These Questions First

Before committing to a language, spend time answering a few key questions:

• What type of work interests you? Web development, mobile apps, systems programming, data analysis, game development, and security tooling all favour different languages.
• How much experience do you already have? Beginners benefit from languages with readable syntax and large learning communities. Jumping straight into a lower-level or more complex language (such as Rust or C++) without prior programming experience can be discouraging.
• What are your career goals? Freelancing, joining a large tech company, working at a startup, or specialising in security each carry different language preferences. If you are targeting a specific employer, research the languages they use in production.
• How much time can you dedicate? Some languages have a steeper learning curve and require more practice before you become productive.

Keep in mind that many programming languages share syntactic patterns and underlying concepts. Learning one language thoroughly makes picking up a second significantly easier.

Five Programming Languages Worth Considering

Java

First released in 1995, Java has maintained broad adoption across enterprise back-ends, Android mobile development, and large-scale distributed systems. Its “write once, run anywhere” design means Java applications run on Windows, macOS, Linux, and other platforms without recompilation.

Java’s longevity means the job market for Java developers remains consistently strong. The language is also well-suited to beginners: its strict type system and verbose syntax encourage good habits, and the ecosystem of tutorials, courses, and community support is vast.

Best used for: Back-end web development, Android mobile development, enterprise applications, desktop applications.

JavaScript

JavaScript is the dominant language of the web. Every major browser executes JavaScript natively, making it unavoidable for front-end development. The rise of Node.js extended JavaScript to the server side, and frameworks such as React, Angular, and Vue have made it the foundation of modern web application development.

If your career path involves building or securing web applications, JavaScript is essential knowledge. It is also a practical choice if you want flexibility between front-end and full-stack roles.

Best used for: Front-end web development, full-stack web development, browser-based tooling.

PHP

PHP, also dating to the mid-1990s, was designed specifically for web development and can be embedded directly inside HTML. This tight integration with HTML makes it approachable for beginners working on web projects. A substantial portion of the web — including platforms built on WordPress, Drupal, and Laravel — runs on PHP, which keeps demand for PHP developers steady.

PHP is not the trendiest language, but its simplicity and the sheer volume of existing PHP codebases make it a practical skill, particularly for freelancers and developers maintaining legacy web infrastructure.

Best used for: Back-end web development, content management systems, server-side scripting.

Python

Python has become the go-to language for scripting, automation, data analysis, machine learning, and security tooling. Its syntax emphasises readability — code is structured with indentation rather than braces, which reduces visual noise and makes programs easier to audit.

In the cybersecurity space specifically, Python is widely used for writing exploit scripts, building security tools, automating penetration testing tasks, and analysing network traffic. Tools such as Scapy, Impacket, and many frameworks in the offensive and defensive security ecosystems are Python-based.

Python is considered beginner-friendly, and its compatibility with data science libraries (NumPy, pandas, scikit-learn) makes it valuable if you want to move into threat intelligence or security analytics.

Best used for: Security scripting and tooling, back-end web development, data analysis, automation, machine learning.

C#

C# is a statically typed, object-oriented language developed by Microsoft as part of the .NET ecosystem. It is the primary language for building Windows desktop applications and is closely associated with Unity, the widely used game engine. Developers using Unity to build 2D and 3D games write their logic in C#.

C# is also used with the Xamarin platform for cross-platform mobile development. If your interests lie in Windows-native software, game development, or mixed-reality applications, C# is a strong choice. Its syntax is similar to Java and C++, so transitioning between these languages is relatively straightforward.

Best used for: Windows application development, game development (Unity), cross-platform mobile development (Xamarin), VR/AR applications.

Quick Reference: Language by Use Case

Choosing Based on Career Stage

Your current experience level should influence your choice:

• Complete beginners: Python and JavaScript offer the gentlest on-ramps, with readable syntax, interactive development environments, and enormous communities producing tutorials and answered questions.
• Developers with some experience: Java or C# provide exposure to strongly typed, object-oriented patterns that are common in enterprise environments. PHP is a practical add-on if web development is your focus.
• Security-focused developers: Python is near-essential. Understanding C or C++ basics is valuable for understanding vulnerabilities at the memory level, though these are more demanding languages to learn.

The Broader Picture

The programming language ecosystem evolves continuously. New languages emerge, existing ones gain or lose framework support, and employer preferences shift. The languages covered here — Java, JavaScript, PHP, Python, and C# — have each demonstrated staying power, broad adoption, and active communities, which means learning resources are plentiful and job opportunities exist across industries.

Rather than searching for the single “best” language, choose the one that aligns with where you want to work and what you want to build. Master the fundamentals, contribute to real projects, and picking up additional languages later will become progressively easier.

Introduction: Why Cybersecurity Predictions Matter

Cybersecurity is defined by a constantly shifting threat landscape. Attack vectors evolve, tooling matures, and threat actors adapt faster than most organizations can respond. Heading into 2020, several important trends were converging: accelerating cloud adoption, the early rollout of 5G networks, increasing use of artificial intelligence by both defenders and attackers, and a wave of industry consolidation. The following five predictions capture where security practitioners and analysts believed the industry was heading — and why each area deserved attention.

1. More Security M&A Activity

Consolidation in the cybersecurity market was already well underway by the end of 2019. According to Momentum Cyber’s Cybersecurity Market Review for Q3 2019, the third quarter of that year reached a record high, comprising 146 transactions valued at more than $15.5 billion. This included 39 mergers and acquisitions worth approximately $13 billion, plus 107 financing transactions totalling $2.5 billion.

The prediction for 2020 was straightforward: niche and emerging security vendors would continue to be acquired by larger, more established players seeking to fill capability gaps quickly rather than build internally. The strategic rationale was clear — buying proven technology accelerates time-to-market and eliminates a competitive threat in a single move.

A prominent example from late 2019 was VMware’s acquisition of Carbon Black, a move that signalled the intent of major infrastructure vendors to embed security directly into their core platforms rather than treat it as an add-on. VMware projected that the Carbon Black business would contribute approximately $1 billion in revenue in the near term. This “security baked in” philosophy — rather than bolted on — represented a meaningful architectural shift in how enterprise security is delivered.

2. Open Source Security Takes Hold

The security industry has historically been slower to adopt open source practices than other technology sectors, often citing concerns about exposing vulnerability information or undermining commercial differentiation. By the end of 2019, however, several significant open source security initiatives suggested that attitude was changing.

Google and a coalition of partners launched OpenTitan, an open source project focused on silicon root of trust (RoT). The project aimed to produce a reference design for a RoT silicon chip, along with integration guidelines for use in data center servers, storage hardware, and other devices. Establishing a hardware-level root of trust is fundamental to supply chain security — if you cannot verify the integrity of the silicon, you cannot fully trust anything running above it.

Separately, IBM Security and McAfee co-founded the Open Cybersecurity Alliance (OCA), an initiative organized under OASIS (the Organization for the Advancement of Structured Information Standards). The OCA’s stated goal was to create interoperable security technologies through shared open source code and content, reducing the friction caused by siloed, vendor-specific security tooling. Interoperability remains a genuine pain point in enterprise security stacks, where teams often manage dozens of tools that do not natively communicate.

The prediction was that 2020 would see broader industry adoption of open source security frameworks, driven by growing customer demand for transparency, collaboration, and vendor-neutral tooling.

3. Security Moves to the Edge

As workloads have moved from centralized data centers to distributed cloud and edge environments, the traditional perimeter-based security model has broken down. Routing all traffic through a central security stack introduces latency and becomes a bottleneck — an unacceptable tradeoff when low-latency connectivity is a core business requirement.

The emerging answer in 2019 was to distribute security capabilities closer to where users, applications, and devices actually operate. Several vendors were already building in this direction:

• Netskope launched its NewEdge infrastructure to deliver cloud security services with lower latency by positioning security closer to cloud on-ramps.
• Forcepoint rearchitected its Web Security platform with edge delivery in mind.
• Palo Alto Networks positioned its Prisma Cloud platform as a cloud-delivered security service spanning multiple environments — what analyst firm ESG described as an “elastic cloud gateway” model.

Palo Alto Networks also announced a partnership with Google Cloud to develop a multi-cloud security framework using Prisma Cloud. The prediction for 2020 was that edge-delivered security would shift from a differentiator to a baseline expectation, especially as 5G and IoT deployments expanded the number of endpoints requiring protection.

“We see a lot of vendors heading this way and we do see this as the way all should or will move in the future.”

Doug Cahill, Senior Analyst and Director of Cybersecurity Practice, ESG

4. AI Will Accelerate Both Security Response and Attacks

Artificial intelligence and machine learning were already being applied to security operations by 2019, primarily for threat detection and anomaly identification at a scale and speed that human analysts cannot match. The volume of telemetry generated by modern cloud environments, endpoint agents, and network flows makes manual triage effectively impossible without automation.

However, the same capabilities that make AI valuable for defenders also make it valuable for attackers. The prediction heading into 2020 was that AI-enabled offensive techniques would become more prevalent. Specifically, security vendor Blue Hexagon forecast that malware using AI models to evade sandbox analysis would emerge. Traditional sandbox evasion relies on static rules to detect a sandbox environment — for example, checking for signs that the malware is running in a virtual machine rather than on real hardware. AI-based evasion would allow malware to more accurately analyze its execution environment, making sandbox-based detection less reliable.

Blue Hexagon CTO Saumitra Das wrote: “As a result of these malware author innovations and existing limitations, the sandbox will become ineffective as a means to detect unknown malware.”

The broader implication for security teams is that AI is not a silver bullet. As defenders adopt AI-assisted tooling, adversaries adapt. Security operations need to treat AI as one layer of a defense-in-depth strategy, not a replacement for other detection and response mechanisms.

5. 5G Security Becomes a Real Concern

Commercial 5G network deployments began rolling out at scale in 2020, and with them came a new and significantly larger attack surface. Unlike previous generations of mobile networks, 5G is built on a more complex, software-defined architecture. This introduces both the flexibility of software-driven networking and the corresponding security risks of software vulnerabilities, misconfiguration, and supply chain exposure.

Key concerns identified by security researchers and vendors heading into 2020 included:

• Expanded attack surface: 5G networks are designed to connect billions of IoT devices. Each additional endpoint is a potential entry point for attackers. IoT devices are notoriously difficult to patch and often remain in service for years beyond their intended security support window.
• IoT traffic interception: Vulnerabilities in 5G protocols could allow attackers to snoop on IoT traffic or remotely compromise IoT devices — including, in some scenarios, reprogramming them entirely.
• Supply chain risk: The hardware and software components that make up 5G infrastructure come from a broad set of vendors, each with their own security posture. CEO Saryu Nayyar of Gurucul noted: “The vast 5G supply chain is susceptible to the introduction of vulnerabilities such as malicious software or hardware and poor designs.”
• Confidentiality and availability impacts: Compromised network assets can affect both the confidentiality of data in transit and the availability of services, with downstream consequences for enterprises and consumers relying on 5G connectivity.

Saumitra Das of Blue Hexagon summarized the architectural challenge: “This new architecture means services will operate within a more complex environment with a broader attack surface that requires more security diligence on the part of the service providers.”

Key Takeaways for Security and DevOps Teams

Looking at these predictions together, several themes are relevant for DevOps and platform engineering teams responsible for securing their organizations:

• Consolidation creates integration opportunities — as vendors merge, watch for improved native integrations between security tooling and infrastructure platforms.
• Open source security frameworks reduce lock-in — initiatives like OCA and OpenTitan create vendor-neutral foundations worth tracking for enterprise adoption.
• Security architecture must follow workload architecture — if your workloads run at the edge or in multiple clouds, your security controls need to follow them there.
• AI-assisted detection requires adversarial thinking — assume attackers will probe and probe your detection models; build for resilience, not just detection accuracy.
• 5G and IoT demand explicit security design — connected devices should be treated as untrusted endpoints by default, with network segmentation and least-privilege access enforced at the infrastructure level.

Originally sourced from SDxCentral (December 2019). Quotes and statistics are attributed to their original sources as cited in the SDxCentral article.