The story of how cybersecurity learned to defend the border, and took decades to start looking inside.
There is a precise moment when cybersecurity as we know it was born.
It is 2 November 1988. A young Cornell researcher named Robert Tappan Morris releases, almost by accident, the first worm in history onto ARPANET, the network that would become the internet. Within hours, around six thousand machines grind to a halt: a tenth of the entire network as it existed then. The damage is contained, but the message is unmistakable: networks are vulnerable from the outside.
The response from the technology world is immediate, intuitive, understandable: build a wall.
In the early 1990s, the first commercial firewall appears. The concept is as simple as a locked door: everything coming from outside is potentially dangerous, everything already inside is safe. Watch the border. Filter incoming traffic. Block what looks suspicious.
It is a powerful metaphor. It is visual. It sells well.
And it is only partly right. It would take thirty years to admit that openly.
The market built around a metaphor
Through the 1990s and 2000s, the cybersecurity industry grows at extraordinary speed, almost entirely around the perimeter.
This isn't just firewalls and antivirus. The perimeter ecosystem that develops over those decades is detailed and sophisticated: next-generation firewalls with deep traffic inspection, intrusion detection and prevention systems, secure email gateways, proxies and web filtering, VPNs for remote access, DMZs to isolate exposed services, multi-factor authentication at the perimeter. In the years that follow, EDR for endpoint control and SIEM for correlating security events join the stack.
It is an imposing ecosystem. And it always answers the same basic question: how do I stop someone getting in, or how do I find out as fast as possible if they got in from outside?
This isn't a cynical choice. It is the natural logic of a market following demand. Companies were afraid of what came from outside, and the market answered with tools that protected the border.
There is also a subtler, more important reason.
The perimeter is measurable. A firewall has a dashboard showing how many suspicious connections it blocked today, this week, this month. A monitoring system produces reports with charts, trends, flagged anomalies. Numbers that grow, threats neutralised, demonstrated value. A head of IT can take that report to management and say: here's what we're doing, here's what it's worth.
That is exactly the kind of data a company's leadership wants to see. Concrete, quantifiable, reassuring.
The trouble is that measuring what gets blocked at the gate says nothing about what happens if someone gets in anyway.
The assumption nobody wanted to question
Defence in depth, the idea that security should work in overlapping layers, each designed to detect or contain what the previous one missed, is not a new concept. It has existed in military thinking for centuries. Critical systems have applied it for decades. (We also wrote about it in The strategic importance of layered defense.)
In enterprise IT, it stayed a niche for a long time. There is a specific reason for that.
Adopting defence in depth means accepting an uncomfortable premise: that the perimeter can be breached. That someone might already be inside. That the tools in place, however sophisticated, might not be enough on their own.
For a company that had just invested in a costly, complex perimeter ecosystem, this was a hard thing to admit. For anyone whose business was built on the promise of keeping threats out, it was an awkward position to defend. For a head of IT whose credibility rested on the perimeter, it was shaky ground.
The result was a cultural lag that ran through the whole industry. Not through bad faith or inertia, but through the very human, universal difficulty of questioning a model you have invested in, both financially and emotionally.
Why the invisible is hard to sell
There is one last piece that explains this lag, and it's the most honest one to admit.
Defence in depth is hard to sell because its value is invisible until the moment it is needed.
A firewall that blocks ten thousand suspicious connections a day produces a reassuring metric every morning. A honeypot that stays silent for six months produces nothing, until the day it doesn't. And in that moment it is worth more than any other tool in production. (It's the same principle told through a different image in Mighty Walls. No Alarm.)
But "nothing bad happened" is not a result that fits easily into a report to leadership. It can't be counted. It can't be shown. It doesn't offer the immediate satisfaction of a list of blocked threats.
The market sold what was measurable. Companies bought what they could show. And for thirty years, the space between the perimeter and the critical data, the space a patient threat crosses in silence, stayed almost entirely empty.
Thirty years on
The cultural lag is closing. Defence in depth is finally making it onto the management agenda, pushed by the rising cost of incidents, by regulatory change, by the public visibility of ransomware attacks.
That empty space between the perimeter and the critical data can now be covered. Without a dedicated team, without an enterprise-sized budget, without complexity to manage.
With something simple, silent, already on the network. Something that does nothing, until someone touches what they shouldn't.
That is what Hoxey is. A honeypot designed for the scale and reality of Italian SMBs: near-zero false positives, no noise to interpret. A clean signal when it matters, and silence when everything is fine.
Thirty years after the first firewall, defence in depth is finally within reach of the people who need it most.