# Everyone Has an Agenda

*Part 11 of an ongoing series.* [*\[Start from Part 1.\]*](https://braindump.0x8r41nr07.xyz/day-zero)

* * *

I wrote a sentence in my journal this week that I could have written in 2004, sitting in a conference room with a client who was very sure of something they were very wrong about.

"Don't listen to others who you think know shit — think for yourself, because everyone has an agenda."

I underlined it. Then I looked at where I'd written it — halfway through my first real pentest assignment, in the middle of learning Burp Suite, nowhere near a conference room — and realized I hadn't learned anything new. I'd just re-learned something old, in a new room, wearing different clothes.

* * *

Advertising will teach you this lesson whether you want it or not, usually the expensive way. Every meeting has people in it who sound certain. The client who's certain the tagline is wrong because his wife didn't like it. The account lead who's certain the strategy needs to change because a competitor just launched something loud. The junior planner who's certain because certainty is the only currency they have yet, so they spend all of it, every time. None of them are lying, exactly. They're all just optimizing for something that isn't "what actually works" — job security, ego, a quiet life, a promotion, a story they can tell upward. Agendas. Everyone has one, including, some days, me.

You learn fast that the loudest voice in the room and the correct one are two different variables that occasionally, coincidentally, overlap. Learning to tell them apart — learning to trust your own read even when it's the only quiet thing in a room full of confident noise — took me years. It's arguably the only transferable skill I brought into this career change that I didn't have to relearn from scratch.

* * *

This week it showed up while I was actually doing the work, not just thinking about it. I was deep in Burp Suite, trying to understand access control headers, trying to understand protocols well enough that they'd stop feeling like a foreign alphabet — and at some point I caught myself doing the exact thing I used to watch junior planners do: deferring. Taking someone else's confident framing of "how this is done" and adopting it wholesale instead of sitting with my own confusion long enough to actually work it out.

I wrote it down blunt, no softening: "everything frustrated me — what I don't know, that I behave like a fuckin' dork." And then, underneath that, the correction: "but knowing it from the start in my gut." That's the important part. I *knew* in the moment that I was outsourcing my judgment to sound more certain, faster. My gut flagged it before my head caught up and gave it a name.

That's not a cybersecurity insight. That's a conference-room-at-a-German-agency insight, applied to a tool I'd been using for a week.

* * *

Here's where the two fields actually rhyme, if you let them: a bad creative brief and a bad security assumption fail the same way. Someone states something with enough confidence that it doesn't get questioned, and everyone downstream builds on top of it, and by the time the crack shows up it's expensive to unwind. In advertising that costs you a campaign nobody remembers. In security, an unquestioned assumption about what a header is actually enforcing is the kind of thing that turns into the story you read about six months later on a breach disclosure page.

The instinct that protects against both is the same instinct: don't accept the confident version just because it's confident. Go verify it yourself. Read the actual header. Trace the actual request. Ask the question that reveals whether the person explaining it to you actually knows, or just sounds like they do — including when that person is me, explaining something to myself, a week into a new tool, wanting very badly to feel like I've got it.

* * *

I moved into Phase 2 of the pentest this week still carrying some of that nervousness — impostor syndrome doesn't clock out just because you had one good insight. But I moved into it having caught myself once already, mid-deferral, and corrected course. That's the whole practice, really. Not eliminating the instinct to trust the confident voice in the room — that instinct is human, and everyone has it. Just catching it faster each time, the way I eventually learned to catch it across a conference table, one bad brief at a time, for thirty years.

Everyone has an agenda. Including the tutorial. Including the forum post with four hundred upvotes. Including, some days, my own certainty that I finally understand something I actually only half do.

Listen to your gut. Then go verify it yourself anyway.