The speaker said security standards may amount to performative paperwork if they are not grounded in technical tests of whether their controls work or matter.

“So one of the concerns with security standards that often feel kind of like theater paperwork is that they don't actually ground out in does any of this work? Does any of this matter?”