A French IT services firm, known as an #ESN, can manufacture a senior professional without spending a euro on #experience: all it has to do is present the junior it hired as one. Junior on the #payroll, senior in the sales proposal, then junior again when somebody has to explain why the project went wrong. A round-trip career managed by people who get paid for every leg.
That is the business worth examining. The #consulting firm gets its margin, the client gets a rate it can proudly show off, and the professional gets #responsibilities nobody thought worth paying for. As long as #documents are delivered and meeting minutes are signed, the arrangement can pass for a well-managed project.
The interesting part starts when it actually has to work.
The price comes down. The assignment stays exactly as it is.
In this purchasing model, the #budget comes before the work is assessed. Then someone is found who will accept the number, and their acceptance supposedly proves that the rate was right all along. An excellent way to measure someone else’s need to get paid. A rather less useful way to calculate the cost of a specialized #service.
For the senior assignments I am discussing, my professional benchmarks are €1,200 to €2,000 a day for a #CISO, the chief information #security officer; €1,000 to €1,200 for a #cybersecurity expert; and €800 to €1,000 for a cybersecurity engineer. That is business revenue, covering professional liability #insurance, #training, #tools, nonbillable time, and obligations that do not disappear when the laptop closes.
Then comes the CISO offer at €700 or €800 a day, with the responsibility untouched and #availability taken for granted. #Procurement has reduced a number. It has not explained which part of the work goes away with it.
That is the trick: negotiate as though experience were a surcharge the #supplier had added on a whim. Cut the rate, but leave the #complexity, the consequences of getting it wrong, and management’s expectations exactly where they were.
They want a Ferrari at Renault Clio prices. And they intend to close the gap by putting “Ferrari” on the invoice.
Experience has value precisely because it lets you distinguish what can wait from what cannot, recognize a failure before it spreads, and challenge a decision while fixing it is still cheap. You do not get that capability by changing a job title. Nor does every service remain intact after you strip away the #resources that sustain it.
A senior professional may accept a ruinous rate to keep the business open. Acceptance proves a need for income, not that you have discovered the true price of the work. If maintaining that discount means juggling assignments, absorbing unpaid hours, and working with no margin for anything, available attention shrinks. The #knowledge is still there. Time and response capacity do not multiply just because the client needs them.
They call that #optimization. Until two clients call at once.
Independent on the invoice, subordinate in the office
The discount often comes with another remarkable expectation: hire independent #judgment and reserve the right to be offended when it is exercised.
The #consultant is expected to arrive fully trained, cover their own #costs, and answer for their #recommendations. But point out that a decision does not hold up, and suddenly there is an attitude problem. Ask for resources, and you do not understand business constraints. Refuse to sign off on something you could not verify, and you lack pragmatism.
#Management’s ideal professional owns a business to pay the bills and thinks like a subordinate when taking orders. #Independence is attractive as a billing arrangement. As a way of thinking, it is quite a nuisance.
Under those conditions, nobody is buying #advice. They are looking for someone to lend technical credibility to a decision already made. The #report must reach the right conclusion, meaning the one that lets everything continue unchanged.
In cybersecurity, this is particularly brilliant: hire someone to detect problems, then make their continued engagement depend on how comfortable you find hearing about them. Afterward, cite their presence as proof that the company had sound advice.
The #contract buys a service and specific commitments. It does not include an obligation to pretend the client knows what it is doing.
The fuse signs the paperwork, too
The junior sold as a senior fits this system far too well. They cost less, have less experience challenging an assignment, and may not yet recognize the responsibility being placed in front of them. #Supervision costs money. Getting a signature is cheaper.
So they are made to produce and sign a mountain of shit in corporate formatting: #assessments they cannot defend, #conclusions they had no means to verify, documents other people need to mark complete. Management approves the work while it clears milestones and generates invoices. Once the #damage appears, management develops a passionate interest in whose name is on the page.
In the sales pitch, this was a senior professional. When the client asks what went wrong, it is back to being the kid who lacked experience.
The #fuse does not protect the IT system. It protects the manager’s job. Its value lies in having a signature to point to several rungs below the person who chose the candidate, allocated the resources, and accepted the results.
At that point, #incompetence stops being merely a technical shortcoming and becomes a way of organizing accountability: #decisions at the top, signatures at the bottom, and surprise shared by everyone when the whole thing blows up.
I know some managers who work this way. I will not name them. They know where I stand on their strategy of operational suicide; my position has never been as ambiguous as their explanations.
The junior should be learning under supervision, not serving as the boss’s liability insurance. And using them as the culprit does not validate a report or restore a system. It only changes the subject of the meeting.
The junior as a fuse: an editorial diagram of the criticized mechanism, not a measure of its frequency in the industry. Created by Raffaele Di Marzio from the argument in this article.
Book the savings now. Deal with the unfinished work later.
The mechanism holds because its results arrive at different times. The discount shows up on the first invoice. Missing capability can take months to become visible, especially when evidence that somebody wrote a document is accepted as evidence of security.
A backup can appear in a report without anyone having tested a restore. A #procedure can be approved without the team knowing how to execute it. Excessive #access can remain in place because fixing it would mean arguing with someone who has more rank than patience.
Until something happens, all of that can coexist with a terrific dashboard.
#ANSSI, France’s national cybersecurity agency, recorded 1,366 confirmed #incidents in 2025 within its monitoring scope. In France, the need to respond to incidents is hardly an exotic hypothesis. Buying the appearance of capability in that environment takes extraordinary confidence that the next problem will happen to someone else.
Skipped work does not disappear. It accumulates and gets tangled up with whatever follows. When #intervention becomes necessary, the first task may be to establish what was actually done, what was merely assumed to have been checked, and what depends on the decision nobody wanted to challenge. You pay for the intervention and for reconstructing a situation that should have been under control.
Besides, a company whose operations have stopped does not negotiate from the same position as one that is planning ahead. It has less time, fewer alternatives, and more people waiting for an answer. The famous commercial pressure ends up changing sides.
If the backlog exceeds what the company can afford to fix, the catacombs stop being a literary exaggeration. You can close a quarter congratulating yourself on the savings while preparing to close the business.
The senior professionals are still at the window
There is a precise irony in the image of senior professionals at the window: these are the people currently deemed too expensive, too demanding, or too unwilling to call a botched job reasonable. They are not asking to be rescued. They are watching the work they may later be hired to do change in front of them.
In that scene, they revise their #rates upward every month. Another month of postponed decisions, another of configurations added to a foundation nobody has reviewed, another of #documentation that will have to be checked against what actually exists. The client is still thinking about the quote it rejected. They are already pricing a different assignment.
Because afterward, they will not be asked to do one part of the project properly. They will be asked to find out which parts are wrong, set the priorities, and move fast while the business is losing money. All of that assumes they are available and willing to take on the mess.
The increase does not need resentment. There is work behind it.
From below comes the complaint that they used to charge less. From the window, something missing from that comparison is perfectly clear: there used to be less shit to fix.
The old quote included the option of getting things done on time. You let that part of the service expire.
Raffaele Di Marzio
🎧 Prefer listening to reading? I talk about it on the podcast, unfiltered and straight to the point.
Pick your platform:
- 🍎 Apple: https://podcasts.apple.com/it/podcast/cyberium/id1770980085
- 🟢 Spotify: https://open.spotify.com/show/5XGYml8cungSi1Hfkai2ZD
- 📻 iHeart: https://www.iheart.com/podcast/53-cyberium-224923335/
- 🎧 Amazon / Audible: https://music.amazon.fr/podcasts/64fb49fa-8fdf-4549-affe-8be9f97d8f22/cyberium
- 🎵 Deezer: https://www.deezer.com/it/show/1001270131
If you enjoy it, subscribe and share it with someone who needs to hear it.
All my “insane” books on cybersecurity and governance are here 👇 https://cyberium.limited/bookshelf.html