> Or are you saying that it's fundamentally impossible to improve security in internet-connected systems because people are not equipped to do so?

Yes - but I don't think think it's that hard. There's 90% easy work to be more secure than most out there. It just requires expertise and for people to change how they work.

Instead people spend $bn on cyber security when you can get 97% of the way there by following good standards and knowing your systems.

I am by no means perfect, I spent all day Friday fixing hundreds of machines manually that had BSOD'd from CrowdStrike. In this case the vendor had made it impossible to do my job well because they offered zero control on how these updates are rolled out - there is no option to put them through QA first. Unlike the sensor itself, which we do roll out gradually after it has been proofed in QA.