Built Wrong
Richard Bird has spent decades inside the cybersecurity industry and has questions about the results. A seven-time C-level executive, author and speaker, he writes about security, AI, identity, privacy and the uncomfortable gap between what the cybersecurity ecosystem promises and what actually happens. Built Wrong is where he works through what we got wrong, why it matters, and what we should build instead.
Oct 06 • 4 min read
The "Remedy" Nobody Measures Part 3: The Buyer Is Not the User
|
Built Wrong: Why Cybersecurity Keeps Failing and How We Can Rebuild It launches on 10/20/2026! ebook presales are open on Amazon and print versions will be available on launch day, although newsletter subscribers might get an advanced purchase opportunity! Stay tuned! Continued from The "Remedy" Nobody Measures - Part 2 None of this requires a conspiracy.Organizational theory has a name for how an entire field converges on the same practice without a meeting: institutional isomorphism. Paul DiMaggio and Walter Powell described the forces that keep organizations “more similar without necessarily making them more efficient.”²⁶ The pressure comes in three forms. Coercive pressure comes from law. Connecticut requires at least 24 months of identity theft prevention services when SSNs are breached.²⁷ Massachusetts requires 18 months, and 42 months when the breached company is itself a consumer reporting agency.²⁸ California and Delaware carry their own requirements.²⁹ Mimetic pressure comes from uncertainty. When nobody knows what works, everybody copies what everybody else does. The GAO’s finding that one year of monitoring has simply become the industry standard is mimetic isomorphism in a single sentence.³⁰ Normative pressure comes from the profession: breach counsel playbooks and insurer-approved vendor panels. Economists would add that providing credit monitoring is a credence good, something a buyer cannot evaluate even after using it. Markets for credence goods underproduce evidence of quality and effectiveness unless something forces the issue. The credit and identity monitoring market is worse than the textbook case, because the buyer and the user are different people. The breached company buys the service. The consumer uses it. The insurer often pays for it: standard cyber policies list credit and identity monitoring among covered breach response costs.³¹ None of the three ever sees whether it worked. The plumbing is visible, but it isn’t questioned. Brit Insurance’s published breach response panel names Equifax, Experian, and TransUnion as its credit monitoring vendors.³² Epiq, which runs notification and monitoring for breached organizations, pitches that its service will help you “protect your business and avoid litigation.”³³ Sold to the payer as litigation management. Delivered to the consumer as protection. Two messages, one product, zero measurements. The litigation math Does the offer actually shield the company? Not cleanly. In Remijas v. Neiman Marcus, the Seventh Circuit used the retailer’s credit monitoring offer as evidence that the risk was real, reasoning that a company would not make the offer if the risk were “so ephemeral that it can safely be disregarded.”³⁴ Where the product earns its keep is the settlement. In the Equifax class action, class counsel supported a $77.5 million fee request in part by claiming credit for nearly $6 billion in credit monitoring, valued at $1,920 per class member. Objectors argued the monitoring was worth perhaps $5 per person.³⁵ One plaintiffs’ firm announced that buying the same monitoring at retail for the whole class would exceed $282 billion.³⁶ Then the public voted with its feet. So many people chose the cash option that the $31 million set aside for it was swamped. Within a week, the FTC was warning claimants that the cash would come nowhere near $125 and urging them to take the monitoring instead.³⁷ The regulator did the valuing itself, telling consumers the monitoring was worth hundreds of dollars a year at market price.³⁸ The court awarded $80 million in fees.³⁹ That is a self-licking ice cream cone. The unmeasured product inflates the settlement value, the settlement value supports the fees, and the settlement delivers more of the unmeasured product. Both sides of the breach The bureaus occupy a position no other party in this market holds: they lose the data, and they sell the remedy. TransUnion’s annual report to the SEC describes its consumer segment as providing solutions that help businesses respond to data breach events, and it tells investors that rising identity theft risk from data breaches is one of the trends it expects to drive demand for its consumer products.⁴⁰ When TransUnion disclosed its own third-party breach exposing more than 4.4 million people in 2025, it offered two years of free credit monitoring and identity theft protection.⁴¹ The clearest view of how the bureaus behave when the market shifts comes from the one control that actually prevents new-account fraud: the freeze. Notes
|
Richard Bird has spent decades inside the cybersecurity industry and has questions about the results. A seven-time C-level executive, author and speaker, he writes about security, AI, identity, privacy and the uncomfortable gap between what the cybersecurity ecosystem promises and what actually happens. Built Wrong is where he works through what we got wrong, why it matters, and what we should build instead.