Security's Hardest Problem Is People, Not

The hardest problem in cybersecurity has never been the technology. Tom Lawrence made that point early in his 500th VLOG Thursday stream, and it's one of those observations that sounds obvious until you sit with it long enough to realize the whole industry is quietly organized around pretending otherwise.

"It's not applying security," Lawrence said. "It's getting people to apply security."

Lawrence runs Lawrence Systems, an MSP and YouTube channel that covers networking, self-hosting, and security for an audience that skews technical. His 500th episode was a live Q&A ranging from industrial control systems left open to the internet, to backdoored consumer routers still available on Amazon, to the uncomfortable reality that your email account is effectively master-key access to everything you own online. There's no single thesis—it's a practitioner talking out loud—but a few threads run through all of it.

The Ignorance Gap

Lawrence opened with a reference to water treatment infrastructure: thousands of ICS devices publicly exposed to the internet, a handful already implicated in attacks on cities. He's done consulting work in this space and describes the experience with a kind of exhausted precision.

The people running these systems aren't stupid. They hired contractors who built something functional. The contractors weren't necessarily security-minded. Nobody thought hard about exposure. An internal voice—maybe a security-conscious IT person—waves their hands and says this is bad, and gets ignored until something actually breaks.

"I was calling them idiots," Lawrence said. "It's honestly the proper terminology to use is they're ignorant. They are ignorant of the threat."

That distinction matters. Ignorance is fixable. Stupidity implies you can't change it. The challenge is that ignorance at scale—across government systems, small businesses, managed service providers—produces outcomes that look indistinguishable from malice. One MSP Lawrence described had a single exposed port. Behind that port sat 30 to 40 client businesses, all of which got hit.

The industry has known for years that MFA adoption and keeping management interfaces off the public internet are the baseline. "Identity is the new perimeter" has become a recurring theme at security conferences—according to theCUBE Research's coverage of Black Hat USA 2025, the phrase and its variants dominated panel discussions. Lawrence heard it and responded with something between exhaustion and dark humor: it shouldn't still be breaking news. But it is, because implementation consistently lags awareness.

The AI Hype Problem Has a Receipts Problem

Lawrence is a careful fan of Ed Zitron's newsletter, which has been documenting the gap between AI companies' stated capabilities and actual financial performance. What Lawrence finds credible about Zitron's work is the sourcing—every claim linked, every conclusion traceable.

"The AI hype people, they are constantly obscure, vague," Lawrence said. "Everything is 'this is too scary to release on the world.'"

That vagueness is doing a lot of work. When AI companies announce dramatic security capabilities—models that can find vulnerabilities at scale, sandbox escapes that demonstrate autonomous threat behavior—they tend to omit the details that would let anyone evaluate the claim. Lawrence pointed to a reported AI sandbox escape that ran for five days and highlighted what was missing from the coverage: how many tokens were consumed, what the actual escape path was, whether the cost of replication makes it a practical threat vector or an expensive curiosity. Without that information, the story functions as hype regardless of whether the underlying event was real.

His framing for the sandbox escape is worth sitting with. Throw enough compute at any sufficiently complex system for five days and something will eventually find a path out. That's not necessarily a demonstration of scary autonomous intelligence—it might just be the billion-monkeys-on-typewriters scenario with a GPU budget. The industry's reluctance to publish token counts and cost data when announcing these results is, Lawrence argues, a lie by omission.

The contrast he draws is with legitimate security research using AI as a force multiplier. He mentioned Wendell, who built an AI harness to probe consumer hardware for vulnerabilities, then manually validated every finding before publishing. He cited the Mozilla security team's use of an Anthropic tool against their own Firefox codebase, which produced real, patched CVEs—verified, attributed, fixed. "Giving them a tool that you can say, 'go poke this until it breaks,'" Lawrence said, is "a better outcome"—especially because the people doing the fixing understand the code they're touching.

The dividing line Lawrence draws is domain expertise. AI in the hands of someone who can validate its output is a useful amplifier. AI replacing the expert who would do the validation is where the outputs become unreliable or dangerous—and where a lot of the current "vibe coded" security tooling lives.

Backdoored Routers and the Consumer Who Doesn't Know

The most concrete security story Lawrence covered involves ZBTLink routers—budget devices sold on Amazon under names like the AX3000. Research by Volshack found that essentially every firmware image on ZBTLink's download page embeds an RCTL implant that starts at boot, phones home, and is hijackable. The researchers chose not to coordinate disclosure with the vendor, and their reasoning is blunt: coordinated disclosure assumes the vendor didn't intend the behavior. When the implant is started by the vendor's own init script, shipped across two dozen models, present across years of firmware images, there's nothing to coordinate. Publishing detection tooling so defenders can act immediately is the only useful response.

Lawrence noted that Amazon had started pulling the affected models during the stream itself—apparently faster than he expected. Whether that removal sticks, or whether the products reappear under different names (some are already named to resemble TP-Link models), is an open question.

The harder question is reach. Lawrence is frank about who's watching his stream: people who would never have bought these routers in the first place. The consumers actually at risk are buying cheap networking gear on Amazon without thinking about firmware integrity, and they are not reading security research blogs. "Consumers be consuming," he said, with the resignation of someone who has thought about this longer than it deserves.

Email Is God Mode, and Everyone Should Know That

Lawrence's email setup section is buried in a Q&A about Proton vs. self-hosting, but it's one of the more practically useful things in the stream. His core observation: email is the recovery mechanism for everything else. Lose control of your email account and an attacker can reset your MFA, take over your other accounts, and conduct that whole operation in the window before you notice anything is wrong.

He uses Gmail, not because he trusts Google's privacy posture—he explicitly doesn't—but because he trusts Google's security posture. "I have picked this devil that I know," he said. The practical trade-off: Google is unlikely to be breached in a way that exposes his email to outside attackers. Google absolutely will use that email data for its own purposes. Lawrence has decided that's an acceptable cost given the security guarantees.

He backs everything up to Synology. Multiple times a day. Both email and documents. He's tested the restores. This is not exciting or glamorous security advice. It is, however, correct—and the kind of thing that gets skipped because it feels tedious until the day it isn't.

His spam management tip is almost comically simple: filter any email containing the word "unsubscribe" (required by CAN-SPAM for marketing emails) into a folder you never look at. His filter folder, built up over years, contains tens of thousands of emails. His inbox is clean. He's been doing versions of this since he was a mail server admin, and he's genuinely baffled it isn't more widely known.

What Lawrence Is Actually Describing

The through-line across all of this isn't doom. Lawrence isn't a fear merchant—he finds the Canva AI redesign that makes him look ten years older and replaces his logo with something unrecognizable more funny than alarming. He's describing a discipline that has solved most of its own technical problems and is now almost entirely blocked on human and organizational factors.

Backdoored routers make it onto Amazon because consumers optimize for price and Amazon doesn't inspect firmware. Industrial systems get exposed to the internet because contractors optimize for functionality and nobody in the chain has security accountability. AI gets hyped beyond its actual capabilities because the companies selling it have no incentive to be precise and significant market incentive to be impressive.

The tools exist. The knowledge exists. The gap, almost always, is between knowing and doing—and closing that gap is less a technical problem than a political, organizational, and economic one.

That might be the most important security insight Lawrence offered across 500 episodes, and it's the one that doesn't fit neatly in a product brochure.

Rachel "Rach" Kovacs covers cybersecurity and privacy for Buzzrag.