Complexity from chaos. Insight from complexity.

The problem

Understanding what could actually affect you is the first step to preventing it. But almost all security advice aimed at families is either fear-driven marketing for a product, or a checklist written by someone who has never sat at your kitchen table and looked at your actual router.

Meanwhile the exposure is real and growing. A household now runs more internet-connected devices than a small business did fifteen years ago, with none of the staff, budget or policy that a small business would have. The gap between what families are expected to manage and what they have been equipped to manage keeps widening.

Businesses answer that gap by spending — collectively billions a year on monitoring, segmentation, patching programmes and people whose whole job is watching. A household gets whatever configuration the hardware shipped with, and keeps it, because nobody ever said otherwise. The default password, the remote administration left switched on, the single flat network carrying the doorbell camera and the laptop with the tax returns on it: those are not mistakes anyone made. They are just what came in the box.

The uncomfortable part is that the people scanning for those defaults are not scaling their effort down because it is a house. Automated scanning does not care whose network it found.

The background

Our experience spans two decades of military, federal and enterprise security. It includes U.S. Army cyber warfare operations at warrant officer level on a Cyber Protection Team — the units that hunt intrusions on defence networks, where the adversaries are frequently nation-state actors rather than opportunists.

On the civilian side, we have held principal security architect roles defending a Fortune 50 internet service provider, hunting threats across network traffic measured in petabytes per week and building machine-learning detection pipelines to find behaviour that signature-based tools miss. Before that, cloud security architecture for federal agencies and the Department of Defense, including the first cloud development platform at its agency cleared to operate on live government data.

That is an unusual place to have learned this trade, and it shapes the work: the questions an analyst asks about a corporate network are the right questions to ask about a family home, just at a different scale. The difference is what happens next. In an enterprise, a finding becomes a ticket. Here, it becomes a conversation and, if you want, an afternoon of fixing it properly.

Explaining it is half the job

Depth is worth nothing if you cannot use it. Alongside the enterprise work, we teach cyber security to older adults through a community resource centre — how to recognise a scam call, how to judge whether an email is real, how to think about the smart devices arriving in their homes, and more recently what AI actually is and where it is being used against them.

That teaching is not a side note to this business, it is the method. If an explanation only works for people who already understand it, it is not an explanation.