Every security product sold in the market has its limits. There is no such security product that can protect its users from all kinds of attacks. The objective of every security product is to raise the bar so that known vulnerabilities are prevented and only the unknown vulnerabilites are open to exploits. If you are buying a security product that does not protect you from a known vulnerability, you are wasting your money.

Another interesting observation is building security products is a catch-up game. The bad actors will almost always be one step ahead. The security product builders are on a chase to address the vulnerabilities as soon as they are known to have been exploited by some bad actor.

Based on what a security product is preventing, you will find two kinds of security products in the market.

• Prevent Good Actors From Doing Bad Things - A common example of this type of security product is Data Leak Prevention (DLP). When a good user inadvertantly uploads a document without realizing that the document has SSNs and credit card details, alert the user that they are doing something against the policy.
• Prevent Bad Actors From Doing Bad Things - A common example of this kind of security product is Intrusion Detection Systems (IDS). These systems stop bad actors from getting into the network.

Why is this understanding important? If you are building a security product, you should know which kind of security product it is. Building each of these kinds of security products require different kind of teams.