The placebo effect is usually the realm of doctors and double-blind studies, not SOC analysts. Yet it creeps into our industry every day. Others have pointed out this parallel before. There’s writing on the security placebo effect, and Bruce Schneier has long warned about the dangers of security theater, those visible but hollow controls that make us feel safer without actually stopping threats. Those critiques are important, but they often stop at the “so what?” – we wasted money, we fooled ourselves, we bought a shiny dashboard that doesn’t really help.
The real risk isn’t only internal complacency; it’s how our misplaced spending reshapes the external threat landscape. Every time we fund a placebo solution instead of a meaningful one, we change the evolutionary pressure on attackers. We keep some adversaries fat and lazy, thriving on old tricks, while forcing others to adapt in ways that make tomorrow’s attacks more cunning and harder to defend. What we choose to fund (or neglect) creates cause-and-effect ripples that define how adversaries operate in the long run.
What the Placebo Effect Is (and Why It Hurts Us Long-Term)
In medicine, a placebo is a sugar pill that looks like medicine. Patients take it and report feeling better, not because the pill did anything, but because the belief of treatment produces comfort. That same mechanism shows up in security. The “pill” is the shiny product demo, the new platform with buzzword-laden dashboards. Leadership feels reassured, customers are impressed, and the boardroom checks the box.
But the health analogy also carries the warning: if you treat migraines with a sugar pill instead of the right medication, the underlying illness doesn’t go away, it festers. Placebo security investments create the same long-term damage. They give us confidence without capability. They lull us into ignoring the fundamentals, and they divert resources from defenses that would actually keep attackers at bay. The sugar high wears off, but the breach risk remains.
Why We Buy Security Placebos
If we know these things don’t always work, why do we keep buying them? Psychology and incentives drive it.
- Fear and status: No CIO or CISO wants to be the one who didn’t buy the hot new “AI-driven” solution. Owning the tool signals inclusion and modernity, even when the need is unclear.
- The “worried well” syndrome: Just as healthy people pop daily vitamins to feel proactive, organizations buy overlapping security tools to soothe their anxieties. The vitamin didn’t fix anything, but the act of taking it feels good.
- Value-Added Resellers (VARs): This is the pharma analogy in full. Just as drug reps once steered doctors toward pricier prescriptions with perks and incentives, VARs are financially motivated to push certain vendor products regardless of fit. If your reseller only makes margin selling Vendor X’s tool, guess which “solution” you’ll be pitched? The conflict of interest is baked into the model.
- The “important CISO phenomenon”: There’s also a social reality inside the CISO peer group. If the business isn’t funding your security team, is it really “important”? If you can’t afford the fancy new platforms, does that mean your peers are further ahead? Some CISOs quietly measure their own success by the funding they command and the “trophy wall” of technologies they can point to. The irony is that success becomes defined by what was purchased, not what was protected.
The net result: we are conditioned to buy shiny things, even when we suspect they are placebo, because it eases fear, signals importance, secures social validation, and makes our partners money.
How Adversaries Adapt to Our Misplaced Defenses
This is where the story takes a darker turn. Adversaries don’t read our budgets, but they don’t need to. They run their playbooks, and the results tell them everything they need to know.
If an attack works if phishing emails land, if credentials are unprotected, if unpatched systems crumble, they have no reason to evolve. Why invest in new tricks when the old ones still pay the bills? Weak security lets adversaries stay lazy.
If an attack fails because defenses were strong, alerts were investigated, or credentials were hardened, attackers get the opposite message. They must adapt. They must innovate. They must evolve their tools and tactics if they want to keep feeding their families.
This is attacker Darwinism in action. Our budgeting, strategy, and focus determine which adversaries thrive and which are forced to evolve. When we overspend on placebo solutions, we unintentionally preserve the easy, profitable attack avenues. We keep the cybercriminal ecosystem fat and happy. When we invest in real controls, adversaries are forced to work harder, spend more, and narrow their profit margins.
The arms race isn’t just between nations or APT groups. It’s between every CISO’s budget line and the attacker’s business model.
How to Fix This and Break the Cycle
The cure isn’t glamorous, but it’s proven:
- Recenter on fundamentals. Patching, least privilege, MFA, backups, configuration management: these stop more attacks than any marketing brochure ever will.
- Demand evidence. Before buying, require data showing what risks a product reduces, how it integrates into your stack, and what measurable outcomes you’ll see.
- Check incentives. Recognize VAR conflicts. Seek independent advice. Reward vendors who show transparency about limitations, not just glossy promises.
- Empower people. Invest in your analysts, engineers, and responders. Tools should amplify their judgment, not replace it.
- Test continuously. Use tabletop exercises, red/purple teaming, and validation frameworks to separate real security improvements from placebo effects.
The End of Snake Oil
The placebo effect teaches us that belief is powerful. But belief without capability is dangerous. Our industry has tolerated too much snake oil; solutions sold on fear, FOMO, and incentives rather than results. We need to stop confusing security theater with security reality.
Attackers don’t care about our dashboards; they care about our gaps. By refusing to fund placebos, we send a message – not just to vendors, but to adversaries – that we’ll no longer be predictable in our misallocations. We’ll spend where it counts. We’ll close the easy doors. And in doing so, we’ll force attackers to actually work for their payday.
It’s time to end the placebo era in cybersecurity. No more sugar pills, no more snake oil. Just defenses that deliver.
Want to talk about what a true defense strategy could look like at your organization? Consult with our experts.
Don’t miss another article. Subscribe to our blog now.
{% module_block module “widget_4d478aa0-3bf0-4250-8e4f-c96fabddf96d” %}{% module_attribute “button_text” is_json=”true” %}{% raw %}”Subscribe now”{% endraw %}{% end_module_attribute %}{% module_attribute “child_css” is_json=”true” %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute “css” is_json=”true” %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute “definition_id” is_json=”true” %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute “field_types” is_json=”true” %}{% raw %}{“button_text”:”text”,”link”:”link”,”style”:”group”}{% endraw %}{% end_module_attribute %}{% module_attribute “label” is_json=”true” %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute “link” is_json=”true” %}{% raw %}{“no_follow”:false,”open_in_new_tab”:false,”rel”:””,”sponsored”:false,”url”:{“content_id”:164756427656,”href”:”javascript:postMessage({type:’HS_DISPLAY_CALL_TO_ACTION’,id:164756427656});”,”href_with_scheme”:null,”type”:”CALL_TO_ACTION”},”user_generated_content”:false}{% endraw %}{% end_module_attribute %}{% module_attribute “module_id” is_json=”true” %}{% raw %}8243667{% endraw %}{% end_module_attribute %}{% module_attribute “path” is_json=”true” %}{% raw %}”@hubspot/button”{% endraw %}{% end_module_attribute %}{% module_attribute “schema_version” is_json=”true” %}{% raw %}2{% endraw %}{% end_module_attribute %}{% module_attribute “smart_objects” is_json=”true” %}{% raw %}[]{% endraw %}{% end_module_attribute %}{% module_attribute “smart_type” is_json=”true” %}{% raw %}”NOT_SMART”{% endraw %}{% end_module_attribute %}{% module_attribute “tag” is_json=”true” %}{% raw %}”module”{% endraw %}{% end_module_attribute %}{% module_attribute “type” is_json=”true” %}{% raw %}”module”{% endraw %}{% end_module_attribute %}{% module_attribute “wrap_field_tag” is_json=”true” %}{% raw %}”div”{% endraw %}{% end_module_attribute %}{% end_module_block %}
About the author
Justin is the founder and CEO of nuHarbor, where he continues to advance modern integrated cybersecurity services. He has over 20 years of cybersecurity experience, much of it earned while leading security efforts for multinational corporations, most recently serving as global CISO at Keurig Green Mountain Coffee. Justin serves multiple local organizations in the public interest, including his board membership at Champlain College.
