This is the state Internet security has reached. The problem is becoming bigger than any one company’s defenses. All the billions spent on anti-this and prevention-that technology has bought visibility into the problem, but little more. You can see how bad it is—“instantly”—but you can’t stop it. Your hoses can’t fight these kinds of fires. The tools are maxed out. The idea behind them—detection—has reached its useful limit. Their architecture—signature and pattern-based recognition—is outmoded. The tune from Annie Get Your Gun fills the air as the vendors play Frank Butler to the spammers’ Annie Oakley. Anything you can do they can do better...

The next logical step would be to get strategic about Internet security. Move beyond the arms race—which you can’t win anyway—and attack the problem holistically. Stop securing your systems and start caring for the ecosystem. Get beyond vendor “solutions” and start an industry-wide, no, nationwide effort to fix the public network. Stop trying to build better fly swatters and figure out how to keep the flies away from the damn pie in the first place.

Of course, that kind of effort would require boldness. Vision. Leadership. It’s not terribly profitable. No one’s really stepped up.

Vendors have blocked the PDF spam from inboxes, even if it still clogs the pipes in transit. Spammers, meanwhile, have already moved on. Another e-mail arrives. [Vendor] detects new spam technique. It offers an expert for commentary and links to a giddy blog entry, complete with smiling emoticon. “Yes, say goodbye to the PDF spam wave and welcome the FDF stock spam wave! : )” ...They can do anything better than you.

No they can’t? Yes they can.

Stay tuned: The results of the annual CIO/CSO/PriceWaterhouseCoopers Global Information Security Survey, to be published next month, brings more evidence of this trend. Reach Scott Berinato at sberinato@cxo.com.