We do security already?

Oct 27, 2026 (updated on Nov 09, 2026)

Part 1 of a three-part series about security that runs on feeling instead of measurements. A conversation with Geert De Keyser, security architect and founder of Dunetrails.

The organisations in this series are anonymised and details have been changed. The pattern is, unfortunately, more recognisable than we would like.

You have been in IT for more than twenty-five years, Geert. Where do you start?

Just before the turn of the century, with the millennium bug as my very first assignment. I have been thinking about that one again recently. The millennium bug is sometimes called a hoax, because in the end nothing happened. But turn it around: it may have been one of the best projects ever. An enormous amount of work was done, and that work was probably necessary. When security succeeds, nothing happens. That is also the profession's core problem: nobody sees what did not happen. I started on the helpdesk myself and moved into consultancy around 2010, with a lot of Citrix projects. Citrix is a good school, because it touches everything. You learn Windows from the inside, and you learn that security is a precondition, not a side issue.

You now guide organisations on security. What prompted this series?

Three situations I came across over the years that share one line: organisations that did their best, and still did not become safer in the way they thought they would. At first I thought this was one story. But they are three phenomena with the same cause: nobody measures. Hence three parts. This is the first, about the difference between effort and maturity.

What did you see there?

A team that had genuinely worked for a year. Projects executed, awareness set up, infrastructure improved. No theatre, just work. A baseline measurement had even been done against the Belgian CyberFundamentals framework, CyFun for short, the yardstick of the CCB. You score each measure from 0 to 5, and you immediately see where you stand. That baseline gave 1.67 out of 5. A year later I did the remeasurement: 1.83. 0.16 points of progress, after a year of hard work.

My first reaction was: this measurement must be wrong somewhere. But it was not.

How is that possible?

The priorities were set wrong. No structural change had been made, and the approach changed hands along the way: the person who did the baseline measurement left, a temporary manager came and went again. What remained were loose, often good initiatives without a shared picture. Without architecture and without oversight you plug a few holes, but there are so many holes that the score barely moves. And the measures that already sat low stayed low: governance, insight, follow-up. There was one measurement, and after that nobody looked again. Measuring is knowing, but only if you keep measuring. One measurement is a photograph, not a film.

What does 1.83 out of 5 mean concretely?

CyFun counts 34 basic measures: from policy and risk management to backups, access control and patch management. The basic expectation is that you score at least 2.5 out of 5 on every measure. At 1.83 you are below that across the board. And this is the basic level. Organisations with a heavier classification look at 133 or even 218 measures, with a higher bar. The problem of this organisation was not that the technical projects were bad. The problem was that the projects went straight past the failing functions. You can rebuild a data centre completely and still do nothing about governance. That is exactly what happened.

Was it pointless work, then?

No, and I want to say that explicitly, because the conclusion of this story is not "do nothing". Server migrations, awareness, infrastructure improvements: it was all necessary. But there were also quick wins within reach, and they were never closed. Because nobody had the list. My action list after the remeasurement counted over ninety points by then, and you work through it from critical to high to medium to low. You do not start with the point that happens to look most interesting, or with the project that just got a vendor demo. The order comes from the measurement, not from the agenda of the best-paid voice in the room.

Looking back: what should have happened first?

Two tracks, in parallel.

Track 1 is for the team, and it can start today: building insight. Look at the logs every day, follow up alerts, know where the problems sit. That immediately builds the evidence towards management, because whoever does not know what is going on cannot respond to it. At the same time: close the truly critical items within the existing environment, without waiting for a big project. Not lists of trifles, but quick wins that make a difference.

Track 2 runs alongside it, usually outside the team: building the architecture. Roadmap, tool choices, budget, partners. That track takes time, which is exactly why the team starts on track 1 today. And it is too important to leave to the team alone: the team belongs at the table, but does not have to lead it.

What does an SME with a limited budget take from this?

Start with a baseline measurement, and do not buy on fear. Let the evidence decide what deserves budget, not the latest news item, and certainly not the fear of the past month. And count on measurement never being finished. Even those who have worked as a security officer for years occasionally find a department that bought software without involving anyone, with a critical vulnerability in it. Shadow IT is what that is called, and it happens to the best.

What does such a baseline measurement cost at your company? An honest answer, because nobody dares to talk about that.

That depends on the environment, and I prefer saying that honestly over quoting a lure price. Count on at least two to three days. For a typical SME of ten to a hundred employees, three days already give a good picture against the CyFun basic measures. If the environment is bigger, or there is hardly any documentation and we have to do the detective work ourselves, it goes up, up to ten days. You can keep measuring forever. But the first measurement already changes everything, because from that day on you know what comes first instead of guessing.

Suppose a reader recognises their own organisation in this story. What should they do this week?

Plan an audit. Set up a conversation, and we measure together. Within a few weeks you know where you stand, and above all: what comes first. Whoever is not ready for that sets a first measuring point with the free email scan. But whoever recognises their own organisation in this story: start with measuring, not with buying.

In part 2 of this series, we cover why buying tools is not security. More about the Security Audit of Dunetrails, or try the free email scan first? You find both on dunetrails.be.