The Feynman Betting Strategy and the Inertia of Security
Many years ago, I read a book by the legendary quantum physicist Richard Feynman. One story from his time at Los Alamos during the war has always stuck with me. Feynman entertained himself by making bets with his colleagues about various wartime events in Europe. He won”Š”, “Šand won a lot. He won so often that his colleagues, naturally impressed by his scientific stature, assumed he had developed some profound forecasting technique rooted in the depths of quantum physics. Eventually, Feynman revealed his “secret.” It was deceptively simple: he always bet that things would stay exactly as they were. Would the Germans take a certain city? “No.” Will the third bombing raid destroy a key Rhine bridge? “No.” Was a major dramatic change imminent? “No.” And so he won. He won a lot. He didn’t need quantum mechanics. He needed a base rate. Feynman was, arguably, the world’s first Bayesian troll.
The Power of IT Inertia
I’ve used this story frequently in discussions about security predictions because it mirrors a lesson I learned during my eight years as a Gartner analyst: IT inertia is the most powerful force in the universe. It is the only force known to survive three digital transformations, two technology revolutions and a dozen re-orgs. If a company does something a certain way today, it’s a very safe bet they’ll still be doing it that way tomorrow. Or in 2033. Now, I’m not an idiot, and neither was Feynman. This strategy is not foolproof; it fails dramatically when the world actually does change. Also, Murphy’s Law guarantees it fails at the worst possible moment, right when you are puffed up full of “predictioneering” hubris. The deeper message is that most predictions miss the speed of change, not the direction. We are prone to Amara’s Law: we overestimate the short-term impact of new tech and underestimate the long-term impact. The Feynman bet wins in the short term precisely because everyone else is overestimating; it (eventually) loses in the long term because the long term is where the underestimated change finally shows up. OK, Anton, where are you going with this? This isn’t Instagram”¦ I promise, this is coming!
AI, “Vibe Coding,” and the DIY Trap
Lately, I’ve been reading a lot about organizations’ ability to “vibe code” replacements for their own security tools (discussion). When I see a prediction that AI will radically transform “cyber everything” in the next 90 days, my Feynman instinct screams to bet against it. History is on my side. Similarly, enterprise DIY projects have a uniquely high failure rate”Š”, “Šif you failed to build a custom Hadoop cluster in 2010, why would you succeed in building a custom, AI-generated SIEM or EDR today? The technology changed; your organization didn’t. And the Hadoop cluster didn’t fail because of Hadoop. But here is where the debate gets more interesting than “DIY bad, vendor good.”
It’s Not the Code. It’s the Content (and the Data)
A security tool is not just code. It is code + content + data, in wildly varying proportions. And AI is”Š”, “Štoday”Š”, “Šspectacularly good at the first and mediocre-to-useless at the other two. You can vibe code an agent; you cannot vibe code a threat research team (you can give an agent to a threat research team and they will be much better as a result). You cannot vibe a decade of malware telemetry into existence. This means the vibe coding question has a different answer per category: Firewall: mostly code (+ policy you already own). Packet filtering logic is decades old, exhaustively documented, and thoroughly represented in every model’s training data. The “content””Š”, “Šthe rules”Š”, “Šis yours to begin with. Vibe coding a basic firewall is”¦ actually kind of plausible? (Please don’t for many other reasons! But it’s plausible, based on this particular theory) Content ratio: low. EPP/EDR: the code is the cheap part. The agent is software, sure. But the value is the content: detection rules, behavioral analytics, ML models trained on billions of endpoint events, cloud reputation, and threat intelligence refreshed continuously by attack data. Vibe the agent all you want”Š”, “Šyou have vibed yourself a very elaborate way to detect nothing. Content ratio: extreme for EPP, large for EDR. SIEM: kinda sorta in the middle. (Naturally. SIEM has never once in its life given a straight answer.) The platform”Š”, “Šingest, store, search, correlate”Š”, “Šis code, and honestly not magical code. But then come the hundreds of parsers that must not drift (but must evolve with data) , the detection content that must map to your environment, and the real killer: data gravity plus years of accumulated operational muscle. You can vibe a log pipeline in a weekend (OK, maybe, I have not tried). Can you vibe 500 parsers, a detection rule library, and a team that knows what “normal” looks like in your environment? Partially maybe? Not really. Content ratio: medium-high, data gravity: brutal. GRC: workflow code + your own policies. Closer to the firewall end – the “content” is largely your documents, your controls, your evidence. Content ratio: low-to-medium. This one will “vibe-die” soon, it seems. So the Feynman bet decomposes nicely: bet against vibe-replacement in proportion to the tool’s content-and-data ratio”Š”, “Šnot its code complexity. AI collapsed the cost of code. It has not collapsed the cost of content, and it definitely has not collapsed the gravity of data. Now, behold the X polls! If somebody comes to you and says “we will #vibe code a replacement for our market-leading $CATEGORY tool,” you say”¦
GRC
EDR
EPP
SIEM
Firewall So the X crowd’s gut matches the framework: the more a tool’s value lives in vendor content and accumulated data, the harder the audience laughs at the vibe coder”¦
“What If This Time It’s Different?”
Everything in my soul says the skeptics are right. And yet, there’s a quiet voice in the back of my mind asking: “Anton, what if this time it’s different?” It is dangerous to silence that voice. “The pace of change has never been this fast, yet it will never be this slow again” (Justin Trudeau, Davos 2018). And: “If the rate of change on the outside exceeds the rate of change on the inside, the end is near” (Jack Welch). Feynman vs. Trudeau, base rates vs. exponentials”Š”, “Špick your prophet. Here’s the mechanism, though, not just the vibe. The Feynman bet fails at exactly one point: when the cost of change drops below the cost of inertia. Call it the inertia break-even point. I’m seeing data points from highly respected experts suggesting that complex, low-vulnerability software can now be rewritten with AI”Š”, “Šwhich means for code-heavy, content-light tools, we may have already crossed break-even. For content-heavy tools, we haven’t. Yet. The line will move; the question is how fast, and Amara’s Law says we’ll get the timing wrong in both directions. The Bottom Line: If you ask me today whether a typical large enterprise should vibe code their own SIEM, I’d take a deep breath and still say no. But that “no” is now a priced bet, not a reflex”Š”, “Šand the price changes by category. Firewall-shaped things: the odds are shifting. EDR-shaped things: Feynman still collects your money. SIEM: kinda sorta, as always. Bet against change”Š”, “Šbut re-price the bet every quarter. Inertia is a base rate, not a law of physics. Keep an open mind. Buy infrastructure 🙂 Related blog: RSA 2026: Agentic Future, Analog Fundamentals”Š”, “ŠThe Paradox of Why the Old Guard Still Survives The Ancient Art of SIEM: Why 2003 Problems Look So Familiar in 2026
The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today) was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.
First seen on securityboulevard.com
Jump to article: securityboulevard.com/2026/08/the-feynman-bet-why-you-still-wont-vibe-code-your-siem-today/
