Security is boring until it’s your data.

In the last two weeks, India got two very different security wake-up calls.

First, SBI confirmed that customer records showed up on the dark web. The bank says core systems and funds are safe, and that may well be true. But the people in that data still have their names, numbers and loan details floating around somewhere they never agreed to.

Then PHP had two critical flaws that let attackers run code on a server without even logging in. Fixes went out fast, and cert-in put out an advisory, but a huge part of the web runs on PHP and not everyone patches the day a fix drops.

What struck me is that neither one is exotic. One is about where data sits and who can reach it. The other is about software nobody got around to updating. Boring stuff, until it’s your name in a dump.

I keep seeing security treated as something you add once the product has traction. An enterprise customer asks, an audit lands, or a news cycle like this one scares everyone for a week. And then attention moves on.

The teams that hold up are usually the ones where it’s a habit from day one. Who has access, how fast can you cut it off, what’s actually being logged, when did we last patch?

Curious how it works in your team. Does security get attention on a schedule, or only when something in the news makes everyone nervous?