The Many Faces of the Security Poverty Line - Chris Farris

Tower Bridge - seen from the Tower of London - April 2026

Posted: May 23, 2026

Last Updated: May 23, 2026

cloudsecurity

ai-research

Note: This post is from a research question I presented to Claude about Security Poverty Line, and where specific companies live in various security socio-economic classes. If it feels AI written, because much of it was.

The diagnosis we got right, and the discourse it produced

In 2011, Wendy Nather coined the Security Poverty Line while at 451 Research, and formalized it in her 2013 RSA presentation “Living Below the Security Poverty Line: Coping Mechanisms."1 The idea was simple: there is a threshold of resources, expertise, and influence below which an organization cannot adequately defend itself, no matter how much it wants to. Below that line, you don’t have the budget, you can’t hire the staff, you lack the expertise to evaluate vendor claims, and you have no leverage with vendors, regulators, or auditors. You take what your providers give you.2

Fifteen years on, the concept has been picked up by Cisco (as a “human rights” framing3), the Cyber Threat Alliance, vendor risk specialists, and venture-funded security researchers writing about market failure.4 Nather herself has expanded it well beyond money to include expertise, capability, and influence, and she has pushed back hard on the “just do the basics” trope: “If the basics were easy, they would already be done. Asset inventory, change management, and access control sound simple on paper, but they are extremely hard in modern environments."5

What the discourse has not done in fifteen years is develop the rest of the class structure. The conversation remains stubbornly binary: above the line or below it. Haves or have-nots. The cyber 1% or everyone else.6

This is the same mistake economists have been making about poverty for sixty years, and we ought to learn from it.

What Michael Green’s “Valley of Death” actually tells us

In November 2025, Michael Green published a piece titled “Part 1: My Life Is a Lie” arguing that the US poverty line — calculated as three times the cost of a minimum food diet in 1963, adjusted for inflation — has become a measurement of starvation rather than a measurement of inadequacy.7 Green’s argument runs roughly:

The 1963 formula assumed food was about a third of household spending. Today food at home is 5-7%. Housing is 35-45%. Healthcare is 15-25%. Childcare for families with young children can be 20-40%. If you keep the original methodology and update the food share, the multiplier is no longer three. It is sixteen. The honest poverty line for a family of four today is somewhere between $130,000 and $150,000, not the official $31,200.8

The structural consequence Green calls the Valley of Death . Means-tested benefits are designed to catch people at the very bottom and they cliff hard as income rises. A family climbing from $35,000 to $100,000 loses Medicaid, loses childcare subsidies, loses SNAP, but inherits market-rate costs for all of those things. The $65,000 family is materially worse off than the $35,000 family. The state gave the $35,000 family a life vest. The state told the $65,000 family they are now a “high earner” and tied an anchor to their ankle called “Market Price."9

Green’s frame produces several concepts worth borrowing wholesale:

Participation tickets : the inescapable costs of being a functioning economic actor, distinct from the cost of luxury.

Super-cooled water : a family with $79k of fixed costs on $80k of income looks stable but is one shock away from instant freezing.

Phase change vs. mean reversion : falling below the line isn’t a temporary dip; it’s a state change (bankruptcy, eviction, credit destruction) with its own latent heat. Recovery requires exponentially more energy than the fall.

Altruism is a function of surplus : people in the Valley resent people below the line not because they lack empathy, but because they cannot afford it.

The argument is American in its specifics — means-tested benefits cliffing, privatized healthcare, market-rate childcare, student debt — but the structure of it generalizes. There is a measurement we use to identify crisis, there is a much higher threshold of actual self-sufficiency, and in between there is a population that is invisible to both the support apparatus and the cultural narrative because it appears, on paper, to be fine.

Mapping economic class onto security maturity

There is no clean, agreed definition of “middle class” in the US. Three competing definitions are in active use, and they give meaningfully different answers:

The academic sociology answer (Gilbert/Thompson/Hickey): the upper middle class is roughly 15% of the US population , defined by occupation and education rather than just income.10...