The Illusion of Upgrade: Why Broken Tech Can’t Be Patched into Security

Marc Lueck, CISO in Residence at Zscaler, argues that patching and adding tools onto a 40-year-old firewall-and-VPN architecture cannot fix security, because the architecture itself, not any single vulnerability, is the flaw. He compares this to Maryland's Rourke Temporary Bridge, built to last a decade and still carrying traffic decades later, and walks through cognitive biases, status quo, loss aversion, fear of regret, mere exposure, effort aversion, that keep security teams maintaining tools that no longer deliver value instead of reallocating budget toward higher-value capability. He proposes flipping the typical security investment pyramid: shrink spend on commoditized tools like firewalls and antivirus, and redirect it toward emerging capability judged by outcome rather than tool ownership. He lays out zero trust as five architectural principles, least privilege, least function, least information, least exposure, and negative trust, insisting it is a philosophy to embed, not a product a vendor can sell, since many long-time customers of vendors like his own still have not actually adopted it despite owning the tooling. A long Q&A covers the limits of the NIST zero trust framework, demonstrating control in outsourced cloud environments, and why trust boundaries, not their absence, are what zero trust actually redraws.