Bruce Schneier: The Man Who Made Cybersecurity Everybody's Business

In April 2000, Bruce Schneier wrote something that would become one of the most frequently repeated statements in cybersecurity: “Security is a process, not a product.”¹

It was a fairly simple observation, but it challenged an industry increasingly built around selling software, firewalls and other technologies that promised to keep organisations safe.

Schneier wasn't suggesting that security products were useless. He was arguing that they could never be enough on their own. Systems would have vulnerabilities, attackers would find ways around defences, and organisations needed to prepare for the possibility that something would eventually go wrong.

More than 25 years later, the cybersecurity industry is considerably larger, the technology is vastly more sophisticated, and the number of products available to protect organisations has multiplied. Yet the underlying argument remains remarkably familiar.

That is perhaps the most interesting thing about Bruce Schneier. He has spent much of his career explaining why the latest technological solution is rarely the complete answer to a security problem.

And he knows a thing or two about technological solutions.

Born in New York in 1963, Schneier studied physics at the University of Rochester before completing a master's degree in computer science at American University. He went on to become one of the most recognisable figures in modern cryptography, writing books, designing encryption algorithms and helping bring technical security discussions to a much wider audience.

His first major book, Applied Cryptography, was first published in 1994, with a substantially expanded second edition in 1996.² At a time when the internet was moving towards widespread commercial adoption, the book offered programmers and engineers a detailed introduction to cryptographic protocols, algorithms and their practical implementation.

Cryptography had traditionally been associated with governments, intelligence agencies, academic researchers and specialist engineers. Schneier's book helped make the subject more accessible to people building ordinary computer systems.

It was not light reading. The second edition ran to hundreds of pages, covering everything from encryption algorithms to digital signatures and key management. But it offered something valuable: a serious technical reference for people who wanted to understand how cryptography actually worked rather than simply treating encryption as a mysterious feature inside a product.

Schneier was also developing cryptographic technology himself.

In 1993, he designed Blowfish, a symmetric encryption algorithm intended as a fast, freely available alternative to existing ciphers. It was unpatented, royalty-free and available for developers to use without licensing restrictions.

That openness was significant at a time when encryption technology was subject to considerable political and commercial restrictions. Cryptographic software was also caught up in debates over US export controls and the extent to which governments should be able to regulate access to strong encryption.

Blowfish offered developers a practical option without requiring them to negotiate a commercial licence.

It would go on to become one of Schneier's best-known technical contributions, although its age now matters. Blowfish uses a 64-bit block size, which limits its suitability for many modern applications. Schneier himself advises against choosing it for new systems.³

That is worth mentioning because cybersecurity history can sometimes make older technologies sound timeless. Blowfish was an important contribution, but recognising its limitations is part of understanding its legacy.

Schneier subsequently helped develop Twofish with a team of cryptographers. It became one of five finalists in the competition organised by the US National Institute of Standards and Technology to select the Advanced Encryption Standard.

Twofish was not selected. The competition was won by Rijndael, developed by Belgian cryptographers Joan Daemen and Vincent Rijmen, which became AES.

But reaching the final stage of such an influential international competition was a substantial achievement, and Twofish remains part of the history of modern cryptographic design.

By the late 1990s, however, Schneier was becoming increasingly interested in a problem that encryption algorithms alone could not solve.

You could have excellent cryptography and still have terrible security.

An application might use a mathematically sound encryption algorithm but expose its keys through poor implementation. A company might protect its communications while leaving sensitive information accessible through weak authentication. An organisation could invest heavily in prevention while having no effective way to detect or respond to an intrusion.

The mathematics might be correct, but the system could still fail.

Schneier later described a change in his own thinking. In a 2000 discussion of his book Secrets and Lies: Digital Security in a Networked World, he explained that he had come to understand security primarily as a problem of risk management, in which detection and response were as important as prevention.⁴

It marked a shift from the design of individual technical protections towards examining how security works across entire organisations.

His argument was not that cryptography had become unimportant. Rather, cryptography was one part of a much larger problem involving software, people, incentives, institutions and decisions.

That thinking helped establish the broader public role Schneier would become known for.

Through his Crypto-Gram newsletter, launched in 1998, and his Schneier on Security blog, which began in 2004,⁵ he developed an audience extending well beyond specialist cryptographers.

His writing regularly challenged assumptions about what makes something secure, particularly when governments or businesses claimed that a new technology could eliminate a particular threat.

He also became interested in the difference between security and the feeling of security.

These are not necessarily the same thing.

A highly visible security measure might reassure people without substantially reducing the danger they face. Conversely, a less visible measure might provide considerable protection without making anybody feel particularly safer.

This distinction became a recurring theme in Schneier's writing about terrorism, airport security and public policy.

After the attacks of 11 September 2001, governments introduced extensive new security measures. Schneier questioned whether some of those measures delivered benefits proportionate to their costs, arguing that security decisions needed to be assessed according to the threats they addressed and the risks they actually reduced.

His criticism of what he called security theatre became particularly influential.

The term describes measures that create the appearance of protection without delivering equivalent improvements in actual security.

It is an uncomfortable concept for an industry in which visible activity, expensive equipment and impressive dashboards can sometimes be mistaken for meaningful protection.

But it also requires care. A measure that appears ineffective to an observer may have benefits that are difficult to see, including deterrence. Assessing security properly means examining evidence, not simply dismissing inconvenient precautions as theatre.

Schneier's contribution was to insist that these questions should be asked in the first place.

The same approach shaped his work on privacy and surveillance.

For Schneier, cybersecurity increasingly involved questions about who had access to information, how governments exercised power and what happened when technologies designed for legitimate purposes were used to monitor individuals.

The disclosures made by Edward Snowden in 2013 brought these debates into much sharper public focus.

Schneier became a prominent commentator on the documents revealing the scale and methods of US and allied intelligence surveillance. He argued for stronger protections for privacy and encryption, while criticising government efforts to weaken security systems or obtain exceptional access to encrypted communications.

One of the central arguments in these debates concerns whether a security mechanism can be deliberately weakened for authorised access without also creating opportunities for misuse.

Governments have argued that access to communications may be necessary for investigations into serious crime and national security threats. Cryptographers and security researchers, including Schneier, have warned that exceptional-access mechanisms can introduce vulnerabilities and risks affecting everybody who relies on those systems.

The disagreement is not simply about whether crime should be investigated. It concerns the technical and institutional consequences of creating mechanisms that bypass protections designed to keep information private.

Schneier has consistently approached this as a security problem with political consequences, rather than treating privacy as something entirely separate from cybersecurity.

His interests have continued to broaden.

In Click Here to Kill Everybody, published in 2018, he examined the security implications of an increasingly connected world, where computers were no longer confined to desktops and servers but were embedded in vehicles, household devices, industrial machinery and critical infrastructure.

The title was deliberately provocative, but the underlying concern was serious.

When computers control physical processes, cybersecurity failures can produce consequences beyond stolen information or interrupted online services.

A compromised connected device may be an inconvenience. A compromised industrial control system, medical device or transport network could have far more serious implications.

Schneier argued that society needed to think differently about the security of technologies that were becoming inseparable from everyday life.

He also questioned whether market incentives alone were sufficient to deliver the levels of security such systems required.

That is an important point in understanding his career.

Schneier began by helping to design tools that could make digital systems more secure. Over time, he became increasingly concerned with the economic and political conditions determining whether those tools were used properly, whether products were designed securely and who was accountable when things went wrong.

The progression was not a rejection of engineering. It was a recognition that engineering operates within a wider world.

More recently, Schneier has turned considerable attention towards artificial intelligence.

His 2023 book A Hacker's Mind explored hacking as a way of exploiting rules and systems, not simply breaking into computers. He examined how the same thinking could apply to financial markets, legal structures, politics and other institutions.

The central idea was that systems can be manipulated by people who understand their rules well enough to exploit weaknesses or unintended consequences.

That perspective offers a useful way of thinking about AI.

As artificial intelligence becomes integrated into cybersecurity products, software development and decision-making, new opportunities emerge for both defenders and attackers.

AI can assist with identifying vulnerabilities, analysing information and automating tasks. It can also introduce unfamiliar failure modes, including systems being manipulated through their inputs or making decisions that are difficult to explain.

Schneier's broader argument about security being a process rather than a product is particularly relevant here.

An organisation cannot assume that deploying an AI-powered security tool automatically improves its security. It still needs to understand what the system does, how it can fail, what information it relies on and how people will respond when its predictions are wrong.

That does not make AI uniquely dangerous, nor does it mean machine learning has no place in security. It means that the familiar questions about risk, accountability and implementation remain important even when the technology changes.

Of course, Schneier's influence does not mean his views should be accepted without challenge.

His public writing often takes strong positions on surveillance, regulation and the responsibilities of technology companies. These are areas where reasonable disagreements exist about the balance between individual rights, commercial freedom, public safety and government powers.

His criticism of security products can also be misunderstood. Organisations still need technical defences, and advances in encryption, authentication and automated detection have produced meaningful improvements.

The argument that security requires processes should not become an excuse to dismiss technological progress.

Nor did Schneier invent the idea that security involves people, organisations and risk management. Those principles have long histories across information security, safety engineering and other disciplines.

His particular contribution has been to explain these ideas clearly, repeatedly and often provocatively to audiences who might otherwise have treated cybersecurity as a narrowly technical problem.

That ability to communicate is an important part of his influence.

Cybersecurity has no shortage of specialists capable of discussing complex technical problems. It has sometimes struggled to explain those problems to the people responsible for making decisions about them.

Schneier helped bridge that gap.

His writing brought cryptography to programmers, security engineering to business leaders, and questions about surveillance and digital rights to a wider public audience.

The industry has changed enormously since Applied Cryptography first appeared. Security teams now work with cloud infrastructure, mobile devices, connected industrial systems and AI technologies that would have been difficult to imagine in the early years of his career.

But some of the industry's most persistent problems remain familiar.

Organisations continue to deploy technologies without fully understanding their limitations. Security failures still arise from poor implementation, misplaced incentives and assumptions about what products can guarantee. Governments and technology companies continue to disagree about encryption, privacy and access to information.

And people still want to believe that the next product will finally solve the problem.

Schneier's career offers a useful counterpoint to that optimism.

He helped build some of the technologies that made modern digital security possible, then spent decades reminding the industry that technology alone would never be enough.

For somebody who began his career designing encryption algorithms, that may be his most enduring contribution.

Not the suggestion that cybersecurity can be perfected, but the insistence that we should understand its limitations before placing our trust in it.