What Hump? Thirty Years of Cybersecurity and the Fine Art of Pretending It’s Not a Human Problem

A new transmission from Musing On Society and Technology Newsletter, by Marco Ciappelli
June 6, 2025

A Post-Infosecurity Europe Reflection on the Strange but Predictable Ways We’ve Spent Thirty Years Pretending Cybersecurity Isn’t About People.

⸻ Once there was a movie titled “Young Frankenstein” (1974) — a black-and-white comedy directed by Mel Brooks, written with Gene Wilder, and starring Wilder and Marty Feldman, who delivers the iconic “What hump?” line.

Let me describe the scene:

[Train station, late at night. Thunder rumbles. Dr. Frederick Frankenstein steps off the train, greeted by a hunched figure holding a lantern — Igor.]

Igor: Dr. Frankenstein?

Dr. Frederick Frankenstein: It’s Franken-steen.

Igor: Oh. Well, they told me it was Frankenstein.

Dr. Frederick Frankenstein: I’m not a Frankenstein. I’m a Franken-steen.

Igor (cheerfully): All right.

Dr. Frederick Frankenstein (noticing Igor’s eyes): You must be Igor.

Igor: No, it’s pronounced Eye-gor.

Dr. Frederick Frankenstein (confused): But they told me it was Igor.

Igor: Well, they were wrong then, weren’t they?

[They begin walking toward the carriage.]

Dr. Frederick Frankenstein (noticing Igor’s severe hunchback): You know… I’m a rather brilliant surgeon. Perhaps I could help you with that hump.

Igor (looks puzzled, deadpan): What hump?

[Cut to them boarding the carriage, Igor climbing on the outside like a spider, grinning wildly.]

It’s a joke, of course. One of the best. A perfectly delivered absurdity that only Mel Brooks and Marty Feldman could pull off. But like all great comedy, it tells a deeper truth.

Last night, standing in front of the Tower of London, recording one of our On Location recaps with Sean Martin, that scene came rushing back. We joked about invisible humps and cybersecurity. And the moment passed. Or so I thought.

Because hours later — in bed, hotel window cracked open to the London night — I was still hearing it: “What hump?”

And that’s when it hit me: this isn’t just a comedy bit. It’s a diagnosis.

Here we are at Infosecurity Europe, celebrating its 30th anniversary. Three decades of cybersecurity: a field born of optimism and fear, grown in complexity and contradiction.

We’ve built incredible tools. We’ve formed global communities of defenders. We’ve turned “hacker” from rebel to professional job title — with a 401(k), branded hoodies, and a sponsorship deal. But we’ve also built an industry that — much like poor Igor — refuses to admit something’s wrong.

The hump is right there. You can see it. Everyone can see it. And yet… we smile and say: “What hump?”

We say cybersecurity is a priority. We put it in slide decks. We hold awareness months. We write policies thick enough to be used as doorstops. But then we underfund training. We silo the security team. We click links in emails that say whatever will make us think it’s important — just like those pieces of snail mail stamped URGENT that we somehow believe, even though it turns out to be an offer for a new credit card we didn’t ask for and don’t want. Except this time, the payload isn’t junk mail — it’s a clown on a spring exploding out of a fun box.

Igor The hump moves, shifts, sometimes disappears from view — but it never actually goes away. And if you ask about it? Well… they were wrong then, weren’t they?

That's because it’s not a technology problem. This is the part that still seems hard to swallow for some: Cybersecurity is not a technology problem. It never was.

Yes, we need technology. But technology has never been the weak link.

The weak link is the same as it was in 1995: us. The same it was before the internet and before computers: Humans.

With our habits, assumptions, incentives, egos, and blind spots. We are the walking, clicking, swiping hump in the system. We’ve had encryption for decades. We’ve known about phishing since the days of AOL. Zero Trust was already discussed in 2004 — it just didn’t have a cool name yet.

So why do we still get breached? Why does a ransomware gang with poor grammar and a Telegram channel take down entire hospitals?

Because culture doesn’t change with patches. Because compliance is not belief. Because we keep treating behavior as a footnote, instead of the core.

The Problem We Refuse to See at the heart of this mess is a very human phenomenon:vIf we can’t see it, we pretend it doesn’t exist.

We can quantify risk, but we rarely internalize it. We trust our tech stack but don’t trust our users. We fund detection but ignore education.

And not just at work — we ignore it from the start. We still teach children how to cross the street, but not how to navigate a phishing attempt or recognize algorithmic manipulation. We give them connected devices before we teach them what being connected means. In this Hybrid Analog Digital Society, we need to treat cybersecurity not as an optional adult concern, but as a foundational part of growing up. Because by the time someone gets to the workforce, the behavior has already been set.

And worst of all, we operate under the illusion that awareness equals transformation.

Let’s be real: Awareness is cheap. Change is expensive. It costs time, leadership, discomfort. It requires honesty. It means admitting we are all Igor, in some way. And that’s the hardest part. Because no one likes to admit they’ve got a hump — especially when it’s been there so long, it feels like part of the uniform.

We have been looking the other way for over thirty years. I don’t want to downplay the progress. We’ve come a long way, but that only makes the stubbornness more baffling.

We’ve seen attacks evolve from digital graffiti to full-scale extortion. We’ve watched cybercrime move from subculture to multi-billion-dollar global enterprise. And yet, our default strategy is still: “Let’s build a bigger wall, buy a shinier tool, and hope marketing doesn’t fall for that PDF again.”

We know what works: Psychological safety in reporting. Continuous learning. Leadership that models security values. Systems designed for humans, not just admins.

But those are hard. They’re invisible on the balance sheet. They don’t come with dashboards or demos. So instead… We grin. We adjust our gait. And we whisper, politely:

“What hump?”

So what Happens now? If you’re still reading this, you’re probably one of the people who does see it. You see the hump. You’ve tried to point it out. Maybe you’ve been told you’re imagining things. Maybe you’ve been told it’s “not a priority this quarter.” And maybe now you’re tired. I get it.

But here’s the thing: Nothing truly changes until we name the hump.

Call it bias.

Call it culture.

Call it education.

Call it the human condition.

But don’t pretend it’s not there. Not anymore. Because every time we say “What hump?” — we’re giving up a little more of the future. A future that depends not just on clever code and cleverer machines, but on something far more fragile:

Belief. Behavior. And the choice to finally stop pretending.

We joked in front of a thousand-year-old fortress. Because sometimes jokes tell the truth better than keynote stages do. And maybe the real lesson isn’t about cybersecurity at all.

Maybe it’s just this: If we want to survive what’s coming next, we have to see what’s already here.

- The End

➤ Infosecurity Europe: https://www.itspmagazine.com/infosecurity-europe-2025-infosec-london-cybersecurity-event-coverage

And ... we're not done yet ... stay tuned and follow Sean and Marco as they will be On Location at the following conferences over the next few months:

➤ Black Hat USA in Las Vegas in August: https://www.itspmagazine.com/black-hat-usa-2025-hacker-summer-camp-2025-cybersecurity-event-coverage-in-las-vegas

FOLLOW ALL OF OUR ON LOCATION CONFERENCE COVERAGE

https://www.itspmagazine.com/technology-and-cybersecurity-conference-coverage

Share this newsletter and invite anyone you think would enjoy it!

As always, let's keep thinking!

— Marco [https://www.marcociappelli.com]

📬 Enjoyed this transmission? Follow the newsletter here:

https://www.linkedin.com/newsletters/7079849705156870144/

New stories always incoming.

🌀 Let’s keep exploring what it means to be human in this Hybrid Analog Digital Society.

End of transmission.

Share this newsletter and invite anyone you think would enjoy it!

As always, let's keep thinking!

— Marco [https://www.marcociappelli.com]

_________________________________________________

This story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.

TAPE3 is the Artificial Intelligence behind ITSPmagazine—created to be a personal assistant, writing and design collaborator, research companion, brainstorming partner… and, apparently, something new every single day.

Enjoy, think, share with others, and subscribe to the "Musing On Society & Technology" newsletter on LinkedIn.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Episode 13 - Minitel, the French Network Connection

Advent of Computing

Why France Needed a National IT Plan

The AI-powered Podcast Player