Scars, Standards, and the AI Storm: 5 Hard-Won Truths from a Cybersecurity Legend
Introduction: The View from the Farm
In the sweltering heat of a mid-summer afternoon, sitting on a farm and relying on a Starlink terminal for a digital lifeline, we sat down with Michael Hammer, a man who has been navigating what he calls the “internet fad” since the mid-1970s. Hammer is the embodiment of the cybersecurity “graybeard.” He comes from an era where off-the-shelf security didn’t exist; if you wanted a protocol to work, you had to roll your own from open source or build it from the guts of the standards themselves.
The early days of the internet were a digital Wild West. It was a time when sending an email that appeared to come from whitehouse.gov was a trivial afternoon project because validation was nonexistent. What began as an academic experiment has evolved into a theater of high-stakes digital warfare. This is a distillation of Hammer’s “scars”, hard-won wisdom from a career spent building the foundations of email security and navigating the shifting tides of AI and vendor risk.
The DMARC Origin Story: Why “Set and Forget” is a Myth
Michael Hammer was the architect behind the core of what became DMARC (Domain-based Message Authentication, Reporting, and Conformance). While it is now a global standard, it didn’t start that way. It was originally designed as a “small club” for a handful of large financial institutions, major mailbox providers, and a few high-value brands, including a major American greeting card company, to stop direct domain abuse. It was never intended as a universal fix for every domain on the planet.
To understand the stakes, you have to understand the three-legged stool of email security:
SPF (Sender Policy Framework): A DNS record listing the IP addresses authorized to send mail on your behalf.
DKIM (DomainKeys Identified Mail): A digital signature that uses a public/private key pair to prove a message hasn’t been tampered with.
DMARC: The policy layer that tells receivers what to do if SPF and DKIM fail.
The problem today isn’t the protocol; it’s the hygiene. Organizations are excellent at adds, authorizing a new marketing firm or a phishing simulator, but they are abysmal at deletes. If you leave an old IP in your SPF record after moving to a new provider, anyone who inherits that IP can legally impersonate you.
Furthermore, DMARC is not a silver bullet. It only stops direct domain abuse. It does nothing to stop “Cousin Domains” (lookalike domains like goggle.com) or “Homoglyphs” (using characters from different language sets that look identical to Latin characters). Social engineering bypasses technology by preying on human skepticism, not protocol flaws.
“I’m the guy who came up with the core of what became DMARC, you can blame me if you don’t like it.”
— Michael Hammer
The 3% Investment: Security as an Assurance Level
Most executives treat security as a “compliance tax”, a cost of doing business that yields no return. Hammer argues for a fundamental shift: security is revenue protection.
While there is a one-time cost to modernize, the incremental cost of “baking security in” is roughly 3%. This 3% doesn’t just buy a firewall; it buys a higher Assurance Level. This mirrors the Total Quality Leadership philosophy of Dr. Deming. Hammer recalls an anecdote of an American company asking a Japanese supplier for a shipment with a defect rate of “less than three per thousand.” The Japanese supplier was baffled. To them, a process that intentionally produces defects is a broken process. They eventually sent the 1,000 parts with a separate bag containing three “specially made” defective parts just to satisfy the American’s strange request.
When security is baked into the development lifecycle, “vulnerabilities” become anomalies rather than byproducts. By eliminating these “defects” at the source, you aren’t just checking a box; you are ensuring the survival and effectiveness of the business.
“Security is in the business of revenue protection.”
The 30-Minute Vendor Litmus Test
Security leaders are often the “unreasonable men” who have to say no at the end of a long procurement process. Hammer suggests a proactive 30-minute vetting call that categorizes vendors before the ink is dry on a contract:
Warts but usable: Minor issues that can be managed.
Fixable with contracts: Significant gaps that require legal clawbacks and strict remediation timelines.
Walking time bombs: Fundamental failures that represent an unacceptable risk.
The “litmus test” for these calls is specificity. For example, if a vendor is handling payment data, ask: “How long do you retain logs?” If the answer is anything less than 18 months, they aren’t PCI compliant. Period. Similarly, if a vendor claims their security is “handled by Amazon,” they’ve failed the test. They don’t understand the Shared Responsibility Model, where the cloud provider secures the “pipes” but the vendor is responsible for the data flowing through them.
The Ethical “One Record” Rule and the CEO’s Pen
Under PCI DSS, the threshold for a reportable breach is exactly one record.
Hammer advocates for “doing the right thing early.” Reporting a single breached record is a minor headache; covering it up is a criminal liability. CISOs must act as the “messengers of risk,” not the “owners of risk.” If an executive team chooses to “paper over” a vulnerability to save face, the CISO’s response should be clear: “I understand the decision. Please sign off on this risk in writing. Press hard, you’re making three copies.“
This isn’t just about a “Cover Your Assets” (CYA) strategy. It’s about ensuring informed, risk-based decisions are made by the people who actually own the business risk. Honesty is a survival trait.
AI and the “Vulnerability Burn-Down”
The rise of frontier AI models like Mythos has many security professionals panicking. There is a story of a senior engineer at a major network provider whining about the workload created by Glasswing, an AI triage tool. The tool was finding so many vulnerabilities that the team couldn’t keep up.
But Hammer sees this as a win. Mythos isn’t necessarily creating new vulnerabilities; it is accelerating the disclosure of “landmines” that have been lurking in legacy code for decades. This “vulnerability burn-down” is a geopolitical necessity. In 2017, the Chinese government passed a law forbidding citizens from disclosing vulnerabilities to anyone but the state. They have been stockpiling zero-days for years. AI-driven discovery destroys that advantage by making those vulnerabilities public and patchable.
We must prepare for a future where “SolarWinds-level” events happen once a quarter until the legacy code debt is cleared. However, we must also distinguish between code vulnerabilities and logic vulnerabilities. While AI is excellent at finding a buffer overflow (0.24% of which are actually exploitable in the wild, according to zerodayclock.com), it still struggles with the high-level logic flaws that drive complex breaches.
Conclusion: The Unreasonable Path Forward
Cybersecurity is a journey of “patching early, patching often, and baking it in.” It requires a culture that values honesty over compliance and quality over speed.
As George Bernard Shaw famously noted, the “reasonable man” adjusts himself to the world, while the “unreasonable man” persists in trying to adjust the world to himself. Therefore, all progress depends on the unreasonable man. In the world of security, being “unreasonable” means refusing to accept “everyone is responsible” as a valid strategy.
If you want to know if your organization actually has a security culture, ask yourself one question: “If everyone is responsible for security, why isn’t it on their performance review?” Until security is tied to the bonus plan, it’s just a “fad” that hasn’t quite caught on yet.