Security Theater

ELI5 — The Vibe Check

Security theater is the stuff that looks secure but doesn't actually stop attackers. Mandatory password rotations, security banners nobody reads, checkbox compliance. It wastes everyone's time and creates false confidence.

Real Talk

Security theater (term popularized by Bruce Schneier) describes security measures that create the appearance of protection without materially reducing risk. Common examples: 90-day password rotation, complex-character rules, SOC2 checkboxes untied to actual controls, security questionnaires nobody validates. Real security focuses on threat modeling, least privilege, and tested controls.

When You'll Hear This

"The quarterly phishing test is security theater — it catches nothing." / "Compliance isn't security. Most of that's security theater."