Caution

The tape says caution. It doesn't do anything else.

Security theater is the gap between the appearance of security and the presence of it. The term comes from Bruce Schneier, who applied it first to post-9/11 airport measures — procedures that made passengers feel watched without meaningfully reducing risk. It spread because it described something practitioners already recognized: that a significant portion of what organizations call security is performed for an audience, not for an adversary.

The audience is usually compliance. An auditor checks whether the policy exists, not whether it works. A penetration test runs once a year and certifies last year's snapshot. The SIEM generates thousands of alerts that nobody triages. The endpoint protection tool hasn't been updated since the vendor changed their licensing model. Each of these passes a review. None of them stops an attacker who is paying attention.

The problem with security theater isn't just that it's useless — it's that it creates false confidence. Believing you're protected is harder to fix than knowing you're not. The tape is there. It even says the right thing. It didn't matter.