The Many Faces of the Security Poverty Line

Sat, 23 May 2026 09:37:34 +0000

Wendy Nather coined the Security Poverty Line in 2011. Fifteen years later, the field still thinks in binary — haves or have-nots, the cyber 1% or everyone else. That leaves the entire middle invisible: a Security Upper Middle Class that mostly just shows up to BSides and gets back to work, and a Security Valley of Death that’s the most populated tier in the industry and the least discussed. This post builds a five-tier model by mapping economic class theory onto security maturity — and borrows Michael Green’s Valley of Death framing to explain why mid-market programs keep failing despite real investment.

This is mostly research from Claude, but reflects my framing of the issue

ai-research on Chris Farris

The Many Faces of the Security Poverty Line