To listen to the vendors of business information security services and products—universally known by the faux-cool, quasi-spy name "infosec"—there is safety in numbers, as long as those numbers are big enough and on the bottom of a purchase order.

Walking around Infosecurity Europe 2016, ”Europe’s number one information security event" according to the organisers, you can see the results of this strategy: nearly 400 exhibitors, offering a grab bag of intruder detection, inside threat analytics, bad actor exclusion, malware screening, phishing and whaling protection, and many more, in exchange for their slice of the $80 billion (£55 billion) global infosec budget.

Read the real-world news, though, and the numbers don't seem to add up. Major security breaches and consequent customer damage seem to happen every day—but that’s not an accurate perception. With some 65 percent of companies worldwide reporting attacks getting through, the true daily rate is probably in the high hundreds of thousands. Factor in attacks on personal IT, and a breach rate of around one megacrime per day may even be low-balling it.

Infosecurity Europe seemed as good a place as any to investigate this discrepancy. It’s common to use medical and biological metaphors to describe infosec, with the attacks as pathogens and the security systems as the immune system. Which would make vendors the doctors of the case—so how many would be struck off?

I tried a simple test. Vendors typically claim a high level of technical expertise, especially in their chosen area, and often pride themselves on large numbers of researchers. So, they should know their numbers: how many of the threats you claim to protect against actually get through? A simple percentage would be adequate—the same as, say, the success rate of a particular medication in clinical trials.

“No idea," said one. “It’s impossible to tell,” said another. But surely your clients will tell you if the thing they’ve paid you to vanquish still gets through? “We don’t publish that information."

I tried ten vendors of different sizes—none could give me any idea how well their services and products actually worked. (A couple did, or at least the marketing people told me "100 percent," but rapidly referred me up the corporate interface stack when quizzed about the details. By the time I got to more senior technical people, that 100 percent evaporated.)

There were exceptions. A bright-eyed booth denizen leapt out at me asking if I had any questions about their product, Phishu. So, I asked. “Some of our customers report 100 percent success, but in general we reduce the number of incidents from around 30 to 40 percent successful phishing attacks to three or four percent.” And how does this remarkable technology work? “Oh, it’s not a technology. We’re a training company. We teach employees how to be safe.”

Another company, Plixer, said "that’s a good question that’s very hard to answer," but then gave me a demo of their network traffic analyser and threat detector, showing exactly what it could and couldn’t do, and yes indeed—they knew their stuff and what their customers actually needed. And were clear about strengths and limitations of what they offered. (It’s also very scary out there on the backbones—I’m glad I’m not an ISP who has to worry about such things.)

The problem with infosec isn’t insoluble, but it’s not being well served by the vendors, many of whom have learned to sell promises on fears while not having the wherewithal to back them up. Where the vendor and the customer speak the same language and understand each other, there are far fewer problems—but security is a hard and intricate skein of problems, and it’s easy to choose to believe that which is hard to check. And once you have corporations locked into multi-million-pound codependency relationships with their vendors, it’s very hard to kick the habit.

Three solutions to the infosec problem

Three solutions suggest themselves, illustrated by my experience of the show. One of the over-subscribed technical talks was Travis Smith of Tripwire on how to build a comprehensive security appliance out of a Raspberry Pi and open tools. No, a Pi can’t protect at enterprise scale—but the tools can, with beefier hardware. You can take charge of your own security; spending your money on skilled people who can understand how to use open tools, often as powerful as anything you can buy, is better than hiring in services.

Which leads to the second solution: people buy in security services and products because they don’t know how to do it themselves, and say they can’t find or afford in-house expertise. There’s a fix for both those issues: hire people and train them. It’s worked for most of the history of commerce; a £55 billion industry should be able to relearn how apprenticeships and in-house learning work.

Which itself leads to the third, most important realisation. If vendors were doctors, then indeed many of them would get struck off the medical register—but there’s nobody to do the striking in infosec. There are no standards nor vendor-neutral industry bodies to enforce them, and no coordinated effort by the customers of that world—who pay those billions—to create them.

If every organisation that spends money on external infosec put aside ten percent of that spend, the world would have eight billion dollars to run an organisation that could set those standards, force that compliance, lobby the vendors, create and run those training courses, even fund and develop new open tools. Eight billion dollars is roughly the same size as the University of Cambridge’s endowment: I think that would show a useful return on investment.

The IT community has long prized its independent nature and combative stance. Open source, though, has proved that there are other ways that often work better. The history of work itself proves that when industries organise themselves to look their problems squarely in the face, rather than spending on outside fixes, the results can be remarkable. Infosec is no different: just run the numbers and see.

Rupert Goodwins started out as an engineer working for Clive Sinclair, Alan Sugar, and some other 1980s startups. He is now a technology journalist who's written and broadcast about the digital world for more than thirty years. You can follow him on Twitter at @rupertg.