Security teams are building trustless systems out of their own colleagues
A security team can spend the trust an organization runs on by building its controls as though its own colleagues were the threat. This piece defines what a security team protects and what its job is.
What a security team is protecting
An organization moves because its people extend each other trust without verifying every request. That trust is the mechanism that makes a firm cheaper than a market. The economics of it have a primary source.
Ronald Coase published The Nature of the Firm in Economica in 1937. The paper asks why any firm exists at all. If prices allocate resources efficiently, every job in the economy could be contracted on the open market. No company would need a boundary drawn around it. A firm is the region where directing the work internally comes in cheaper than buying it. Verifying every internal request raises the cost of organising a transaction inside the firm. If you raise it far enough, the open market becomes the cheaper place for work the firm used to do itself. The organization is people and the trust they extend each other.
What a trustless system costs
A proof-of-work chain engineers a stranger's cooperation out of the system. It buys that with continuous physical work for as long as the chain lives, at a cost that is both enormous and counted. A security team that verifies every request, trusts no participant and treats the counterparty as hostile is attempting the same design on its own colleagues. It almost never counts what that costs. Friction raises the cost of coordinating inside the firm. A team that does not measure its own friction cannot know whether it has pushed that cost past the market it was built to beat.
What the job is
A security team keeps an organization able to operate safely. An operating organization changes constantly. The job is to let it change as rapidly as possible under the control set that best fits its needs. Trust is what it spends doing that. Trust is also what it exists to protect. The thing it spends and the thing it protects are one resource.
The line usually attributed to Gene Spafford describes the end state.
The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards
Every control moves some distance toward it. The failure comes from not measuring the impact those controls have on the business and never asking whether they were necessary in the first place.
What the job is measured on
A security team operates as a cost center whose success condition is invisible. A prevented breach does not produce anything to show for it. A blocked deploy produces a ticket, a thread and a missed date. The only visible output of a security team is friction.
What the organization loses as friction rises.
- Time. Delivery lost to the control.
- Money. Spend the control forces.
- Morale. The motivation of the people under the control.
- Observability. What the organization can still see of its own estate.
- Communication. The channels the organization relies on to coordinate.
- Security. The posture itself.
What the team spends to impose it.
- Trust. Standing with leadership and with the people who work under the control.
- Authority. The team's own standing to decide.
A cost is not the same as a net loss. A policy that explains itself and points at a working template is documentation the engineer wanted anyway. A reporting program with a visible reward attached adds engagement to a channel the organization needs working. Both still cost engineering time. A barrier draws these accounts down. A feature carrying the same intent can add to them.
The limit on the employee side is measured. The Compliance Budget (Beautement, Sasse and Wonham, 2008) found that the compliance effort employees will spend is finite and that spending it faster lowers compliance. Saltzer and Schroeder's psychological acceptability, from 1975, had already made ease of use a design requirement so that people apply a protection mechanism correctly.
A control has to be designed around the people it is applied to. The attitude both papers argue against is still the default, where usability is a nice-to-have traded against security whenever the two conflict. Usability is what makes a control produce a more secure outcome.
How to produce those measurements
Twelve artifacts produce them. Each one is a table completed against a real environment. None of them is a score. Each produces a count of rows that failed. That count is an argument for one conversation.
The order matters. Each one needs the answer from the one above it.
| Artifact | What a completed one gives you | What a failing row tells you |
|---|---|---|
| Mandate ledger | A named source per control, from a client contract clause, an insurer requirement, a regulation, an internal threat model, or "we chose it" | The first three are requirements. The last two are optional |
| Adversary attribution check | A named actor for every control aimed at an internal user | A colleague named as the actor is an insider threat control with no insider threat mandate behind it |
| Trustless cost test | The end-to-end price of removing trust from one interaction | A price nobody will pay. The interaction has to be trusted |
| Risk decision ownership grid | Who pays, who owns the residual risk, who signs | Your own team in every column is a unilateral risk transfer |
| Friction budget | Minutes per week per persona, ranked by value bought | The bottom quartile is the deletion queue, with every unattributed row already in it |
| Workaround ledger | The cheapest route around each control | A workaround cheaper than complying is likely buying a worse outcome |
| Persona and environment matrix | Control intensity and approver per persona per tier | A production control on a tier holding no production data is applied to the wrong tier |
| Self-service test | A pass or fail on five named checks, per restriction | Any restriction failing any of the five is a queue |
| Change latency budget | Your published response time per request class | Any class with no published number is a cost nobody has owned |
| Awareness check | Whether people can name and reach your governance system | Anybody who cannot is evidence the governance shipped silently |
| Training-before-testing sequence | The order, the dates, what gets measured | A simulation dated before the training is a trap with your own logo on it |
| Destructive action pre-mortem | What breaks, who finds out, what the rollback is | Any field blank at the point of action means nobody accepted the risk |
A fill-in spreadsheet with one tab per artifact is at friction-budget-worksheets.xlsx.
Run the mandate ledger first. Nothing else has anything to sort on until every control traces to a client contract, an insurer requirement or a cited regulation. Everything left as "we chose it" is elective. An elective control competes for the same engineering time as everything else. A certification like SOC 2 or ISO 27001 is itself elective until a client, an insurer or a regulator names it.
Why all of this is so important now
A slow approval was survivable when the change it gated was also slow. An AI-assisted change now lands in minutes. The review still has to happen. DORA's research on streamlining change approval found no evidence that an external board or a senior manager lowered change failure rates. The review that keeps up sits with the team the change most concerns, in the tool the work already lives in.
The instinct under that pressure is to add more control. A bad one now compounds at machine speed. It repeats across every change until one wrong call is an organization-wide cost. The pace rewards better control. A better control is derived from your own threat model, names the actor it defends against, stays light enough that the people under it apply it without routing around it, and is priced in the units the business already uses. Start with the mandate ledger. A team that cannot say which of its controls are required cannot prioritize any of them. The worksheets turn each artifact into a count you can take to one control owner, one conversation at a time.