A New Era in Security, The People Behind the Code

In the first season, starting with what Web3 is and isn’t, I tried to dive into the depths of the blockchain world. Then I continued by touching on the intersections of today’s traditional/corporate business and finance worlds with Web3. My last few articles focused on how traditional finance is slowly integrating blockchain technology into its infrastructure and the role of stablecoins in this.

At this point, I realized it’s time to start looking at things from the perspectives of code, security, and audit. To be fair, my personal experience and closeness to these topics play a part in this realization.

So, while I started this newsletter from a completely different place, the journey naturally brought us here, and now I’m introducing a new mini-series.

In the first article of this mini-series, I want to start with perhaps the least talked about but most critical layer of the Web3 security ecosystem: the human factor. This theme is personal for me, I began my career in cybersecurity. That’s why I believe that the best comparison between Web2 and Web3 isn’t just through technology, but also through security culture, and that they should actually be compared together.

And this story really begins with the audit and process cultures in the traditional business world. Blockchain and Web3 come into play by adding a new layer of transparency to these structures.

In the traditional corporate world, security and audit are inseparable because systems are closed, code is invisible, data flow stays within the organization, and can’t be verified externally. Despite changes in technology and paradigms, this largely continues. Therefore, security relies on the accuracy of processes, the effectiveness of audits, and the discipline of teams.

In the corporate world, this concept is remembered with very specific processes like:

• The four-eyes/double approval principle
• Change Advisory Board (CAB)
• Independent testing before systems go live
• Segregation of duties
• Approval mechanisms specific to the subject or process

All these layers were actually the result of one question:

“No one can see what’s inside the system from the outside, so we have to check each other.”

That’s why processes were born; that’s why audits became critical. The human factor took center stage because of this.

The biggest difference Web3 brings to this whole system is that, for the first time, the “inside” of the system became visible:

• Code is open-source
• Transactions can be tracked on-chain
• Reserves can be automatically verified
• Data flows can be monitored

For a professional in the traditional business world, this is almost a reverse logic:

“If I can already see inside the system, why is an audit necessary?”

Here’s the critical point: Transparency brings automation, but automation doesn’t completely remove humans from the equation, on the contrary, it places them in a more critical role.

Because:

• The person who writes the code,
• The person who designs the architecture,
• The person who identifies the bugs,
• The person who models the risk,
• The person who makes the improvement decisions is still human.

That’s why Web3 audit firms (like OpenZeppelin, Trail of Bits, Quantstamp, CertiK) are essentially a combination of independent security testing, code review, and architectural verification processes that have been used until now.

Web3 definitely brings transparency, but transparency itself isn’t security. Security still requires interpretation, experience, and discipline.

In environments with a lot of automation, risk becomes invisible.

Classic mistakes in Web2:

• Misconfiguration
• Incorrect permission model/process
• Rushed deployments (everyone’s problem :))

In Web3, the same pattern produces faster and bigger results:

• Oracle error → systematic price error
• Supply chain attack → code infiltrating dependencies
• Logic error → instant financial loss on-chain

So as automation increases, even the smallest human error grows and multiplies. This is a common point between the two worlds.

Audit, whether in Web2 or Web3, is a snapshot.

• If the code changes → risk changes
• If the architecture changes → risk changes
• If user behavior changes → risk changes

Audit only tells us:

“Today’s version behaves like this, in its current state.”

Security asks:

“How will this system behave tomorrow?”

Decentralization or transparency in the blockchain world doesn’t eliminate this difference; it might make it a bit more visible. But being visible doesn’t mean being secure.

That’s why the human factor (design, review, decision-making) is indispensable even in a transparent system.

In this first article, I also wanted to show why Web3 security isn’t entirely foreign to Web2 professionals. Because despite the incredible differences between the two worlds, the security question is the same:

“Why do we trust this system?”

Web2’s answer: process + institution + audit Web3’s answer: code + transparency + on-chain data

But at the heart of both worlds’ answers is still the human.

In the next article, I want to touch on a unique and brand-new perspective on Web3’s security side, a layer that doesn’t quite exist in Web2: community audit, bug bounty, collective verification.

See you next week.