A little better today beats perfect too late

There is a thought that keeps popping up for me, in my professional life as much as in my private one:

“A little bit better today is better than perfect too late.”

My first BackupPC rescue is the clearest example I have. The backup lived on the same machine it was protecting, simply kept apart from the system itself. It was not off site. There was no staged, layered backup scheme behind it. By any proper standard, it was not good enough.

And yet, when a power failure wrecked my root partition, that simple backup was what brought everything back. Without it, rebuilding would have been a massive job. It was not perfect, but it was far better than nothing, and it existed on the day I needed it. The perfect setup I might have built some day would not have helped me at all that day.

The same holds true for security, and product security in particular. It is tempting to wait until there is time and money to do it properly: EDR, XDR, firewalls, SIEMs, a full zero-trust architecture. But waiting has a cost too. I would much rather add a little more security in every cycle. Chances are that one small fix, shipped now, is exactly the one that saves you, while the perfect solution is still on the roadmap.

None of this means perfect is a bad goal. It is a fine direction to walk in. It is just a poor reason to stand still.