Five years ago (2017), Thomas Dullien (aka Halvar Flake) presented a keynote at Black Hat Asia, titled “Why We Are Not Building a Defendable Internet” in which he explored the economics and incentive structures in IT security: Who is incentivised by who to do what - and how these incentives fail to produce the security level we desire. Five years in Internet years is a long time, so what has changed for the better or worse?