Every horror franchise eventually runs out of ideas, and ours keeps getting new material. I've watched enough security programs to know the Saw movies got one thing right: every trap starts with a choice somebody made earlier.

A note before the lights come on. The room is fictional, and so is the person waking up in it, which is you. Every count, date, and quote in here is real, and most of them landed in the last twelve months.

The bathroom

You wake up on cold tile with a chain around your ankle and the worst headache since your last SOC 2 audit. The other end of the chain runs to a pipe under a filthy sink. Across the room, chained to the opposite pipe, sits your CFO, who looks about as thrilled with the arrangement as you are.

Between you, on the floor, lies a cassette player. Somebody has written PLAY ME on it in red marker, because whoever runs this place understands that security people don't read the documentation.

You press play.

"Hello, practitioner. For years you've accepted risk on behalf of other people. You signed the exception, you approved the deferral, you marked it compensating control and moved on to the next meeting. Today you find out how accepting it feels. I want to play a game."

There's a hacksaw in the bathtub. You do what everybody does first and drag it across the chain, and the teeth skate off the steel and go dull in about four strokes. Your CFO watches the whole performance, then asks the obvious question about what else a saw could possibly cut. Nobody wants to answer that one.

Trap one: the flood

The faucet on the tub opens by itself, and above it a counter on the tile starts climbing. It doesn't count down. It counts CVEs, and it only goes up.

"Last year the world published 48,185 CVEs, a record. This year the forecasters expect something like 66,000. On October 13, one vendor fixed 1,411 of them in a single Tuesday, 70 of them critical, after shipping another 348 earlier in the month as a warmup. The national database that was supposed to sort all this out fully analyzed about 28 percent of last year's. Only about 5 percent of CVEs ever get exploited. Find the 5 percent before the water reaches your chin."

Slips of paper start bobbing up with the water, hundreds of them, then thousands. Every slip floating past your knees has a CVE number printed on it, and about one in twenty is printed in red, for the ones somebody will actually exploit. A vendor dashboard bolted to the wall promises to light up the red slips for you, and it does light some of them up, in a shade of orange that means "probably." You can't fish every slip out of the water. Everybody in this industry knows it, and almost nobody says it out loud in front of the CFO, who is now watching the waterline climb past a very expensive pair of shoes.

You glance at the hacksaw and think about every triage meeting you've ever run, where prioritizing really meant deciding which part of the environment you were willing to lose.

Trap two: the lock that was never locked

The second tape plays from inside a cage. The padlock on it glows a reassuring green.

"This fall a frontier AI lab pointed its red team at 25 open source projects and found 493 issues hiding in default settings and the way those settings interact. In 94 cases, a combination of perfectly reasonable options quietly switched off a security control and never told the administrator. One of them went unnoticed for 21 years. Your cage has a lock like that. It shows green. Prove it's locked."

Twenty one years. Somebody's kid was born under that lock and is now legally old enough to drink. You rattle the door, and it holds, and you honestly can't say whether that's the lock or the rust.

The tape doesn't care how confident the console looks. Neither should you.

Trap three: the team

This one hurts, because the trap isn't on you.

On a monitor in the corner you can see your team, each of them strapped to a desk chair. Here's the part the tape wants you to sit with. They're keeping up. They found the red slips from the first trap, they wrote the fix for every one of them, and the fixes are sitting in a queue marked APPROVED PENDING WINDOW.

"Your team knows how to fix all of it, and they aren't allowed. Patch the library and the application on top of it stops working. Ask for a reboot and the business owner tells you it can't go down for a month, and next month it's the same month. Choose which fix you'll fight for this quarter."

That's the real trap, and every practitioner reading this has lived in it. We know how to solve it, we aren't allowed, and we know that's always the answer.

Your CFO, reading over your shoulder, mentions that headcount is flat for next year anyway. For once that's the wrong problem to worry about, because more people would just write more fixes for the same window that never opens. Then the CFO asks a better question than you expected, which is which of these things actually hurts the company if it breaks. You have an answer. It has never once fit on one slide. You both glance at the hacksaw, and neither of you reaches for it yet.

Trap four: the box in the basement

A trapdoor opens under the sink, and the smell tells you exactly where you're headed.

Down there, on a VM called FIN-WEB-OLD-2, lives the timesheet app. Somebody in finance built it in 2017 because the real system took four clicks too many, and that somebody left in 2019 with a sheet cake in the break room. It runs PHP 7.4. It has a public IP because a regional office once couldn't reach it over the VPN and the fastest fix won the argument.

"Last week a pair of PHP flaws that had sat in the code for years went public early, and governments in at least three European countries pulled sites offline rather than find out what was running on them. The key to your chain is the root password for this box. It lives in a spreadsheet tab named DONT DELETE. Find the spreadsheet."

The inventory upstairs says you run PHP on 31 hosts, each with an owner's name in the column. The inventory has never met the timesheet app. Your CFO, it turns out, uses the timesheet app every Friday, and is suddenly very quiet.

Trap five: the visitors who never sleep

You hear them before you see them. Something outside the door tries the handle, then tries it again, then tries every handle in the building, thousands of times a minute, and takes notes on which ones squeak.

"The new visitors run on agents. This month one of the biggest banks in the country said it blocks services that log in with customers' shared credentials, and another started blocking third party AI agents outright. Your defenders run agents too. It's agents all the way down, and you still have one guy named Kevin who knows how the badge system works."

They don't get tired. They don't take Saturday off for trick or treating, and they've already noticed how long your fixes sit in that queue.

Trap six: thirty days of tape

The last cassette is different. It's a loop, and it only holds 30 days.

"Your log retention is 30 days. Somebody decided that three fiscal years ago in a budget meeting that never included you, and at the time it sounded generous. This year the breach letters kept arriving with start dates measured in seasons. If someone moved in last spring, the tape already recorded over them. Tell me who's been in the house."

You can't. That's worse than finding a body. A body at least gives you a place to start.

The tape you didn't expect

In the bottom of the tub, under the hacksaw, there's a phone. On the screen is a post from October 22, by Jason Clinton, the deputy CISO at Anthropic:

"as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)"

Here the jokes stop for a minute.

A man who works at a frontier AI lab told an industry buried in AI pitches to skip the AI line item and go ask for the boring stuff: an owner for everything that faces the internet, logs that outlast the intruder, locks somebody has actually tested, and change windows that open when the fix is ready.

And then you play the six tapes back, and you finally place the voice. It's yours. Every trap in the room came straight out of your own risk register, one exception and one deferral at a time, each signed in good faith by somebody who had a reasonable meeting that afternoon.

Nobody built these traps for you last Tuesday. You built them, one accepted risk at a time, and the new visitors are just the first ones patient enough to spring every one of them.

The saw

The water from the first trap is at your chest now, and the last tape clicks on by itself.

"The chain won't break. You learned that in the first five minutes. One of you has to cut off something you've kept alive too long, and you both already know which one."

You do know. You've known since the trapdoor opened. When you follow the pipe that both chains run to, yours and the CFO's, it disappears into the floor directly above FIN-WEB-OLD-2.

So you pick up the saw, because cutting is the job. You've done it a hundred times. You cut the pen test scope to fit the budget, you cut the logging tier to fit the contract, and you cut your team's weekend to fit the patch window. Every one of those cuts came off your own leg, which explains the length of the risk register and the limp.

This limb isn't yours, though. The timesheet app belongs to finance, and you can't saw through somebody else's business process and call it a security decision. You tried that once. It went to the exception committee and came back as a risk acceptance with your name on it, which is roughly how this whole room got built.

The CFO is staring at the saw in your hand.

"Payroll closes Friday."

"It's been running down there since 2017."

"Who else is on it?"

"About 200 contractors, and a regional office that would rather die than use the VPN."

The CFO holds out a hand, and you give up the saw.

It isn't clean. Nothing in these movies ever is. The sound it makes is two weeks of contractors submitting hours on a spreadsheet, plus a ticket titled URGENT!!! from the regional office manager that will be waiting for you Monday morning. Then the network cable parts, the box in the basement goes dark for the first time in nine years, and both chains slide off the pipe at once.

The CFO rubs one ankle, looks down through the trapdoor, and asks the only question that matters in the entire franchise.

"What else is down there?"

Then the CFO hands the saw back to you. "Keep it. We're going to need it."

Security can find the limb, and security can hand over the saw. The cut only holds when the person who owns the limb makes it.

Game over, in eighteen months

Most security leaders will waste this crisis. They'll thank the team at the next all hands and go back to asking for the same budget line they asked for in June, because asking for the basics feels like admitting you never had them. It is admitting that. Your board would much rather hear it from you this quarter than read it in a breach notification next year.

That question from the CFO is the board conversation Clinton was asking for. You walk in carrying the scariest thing in your basement, by name, and the people who own the business decide what gets cut and what gets funded, on the record, with their names on the decision instead of yours.

Eighteen months from that post lands in late April 2028, which runs straight through next Halloween. In the movies there's always a sequel. You get to decide how many of these traps are still standing by the time it opens.

So, here's the Halloween move

Pick the trap in your own room you're most afraid of, take it to your next board conversation by name, and ask for help with the basics underneath it.

Put down the hacksaw and go call your CFO. Game over is optional. Happy Halloween.