Marlene Dehart on security by expectation, not exception

First Principles is a conversation series where I ask engineering and security leaders the questions that usually go unasked: how their teams actually behave, what they can't see, and what they've learned the hard way.

In this conversation, Marlene and I talked about why curiosity matters more than a technical background, why security exceptions should be rare, why machines need the same fundamentals as people, and why encryption keys need an inventory of their own.

Watch on YouTube

Key moments

1. Who can learn cybersecurity

   Her years in space and cyber taught her that anyone with the right competency, attitude, and curiosity can be taught the cybersecurity field.

   It's not always the technical background. It's being more curious, and you can teach people hands-on.

2. Security by expectation, not exception

   Security exceptions should be very rare, because there is always a way to manage the risk. The goal is to set clear expectations with stakeholders and find ways to say yes to what the business wants to do, so it never needs to become an exception.

   We should have security by expectation, not exception.

3. Managing risk, and why resiliency is back

   Every business operates with risk. The skill is knowing your risk tolerance, knowing when to say yes, and preparing to recover from the unknown. She sees resiliency back at the center of the conversation, and she encourages leaders to judge their services the way they would as customers.

   The art of being a cybersecurity leader is finding a way to help the business move forward.

4. Giving machines their own identity

   Machines and workloads need their own identities, and the same fundamentals that apply to people apply to them.

   The fundamentals apply. First principles thinking. Least privilege.

5. Encryption keys need an inventory too

   With post-quantum cryptography raising the risk that data stored today can be decrypted later, strong secrets management matters more than ever. She argues for something like a software bill of materials for cryptography and keys: an inventory that keeps keys separate from the data but linked to it, so encrypted data can still be recovered across long retention periods.

   I think we need something very similar for cryptography and for the keys that we're managing.

6. What tools don't show you

   The information she most wants is about human behavior: how people understand and use technology, for good and bad, especially now that agentic AI seems to reason like humans.

   Understanding how humans interact with the technology, I think, is extremely important.

7. Why open source is back

   She sees open source making a comeback, in models, in hardware, and in the transparency that comes from developers sharing their work with the world.

   Open source is making a comeback.