I've spent 20 years in cybersecurity watching the same patterns repeat. We sell fear. We chase compliance, then we act surprised when breaches happen