The Pale Rider & The Persistence of Memory

What a society does not count, it loses. What it counts, it can still forget.

Forgetting is the most dependable thing a pandemic leaves behind, and the same holds, in miniature, for a cybersecurity career. Much of the work shows up as nothing going wrong, and the evidence it does leave behind stays locked inside the employer who owns it, hard for the next one to trust.

The largest modern case of the same forgetting is the deadliest pandemic of the last century, and public memory keeps it almost nowhere. The influenza of 1918 ran through the same years as a war that is cut into stone in a thousand town squares and marked on a fixed day each year; the flu has no monument most people could name and no date set aside for it. Laura Spinney, whose history of the outbreak takes its measure, describes a catastrophe that survives in collective memory mainly as a footnote to the war beside it.

Part of the reason is that the pandemic defied counting from the start, and still does. A century on, estimates of the global dead still range from roughly 17 million to as many as 100 million. The distance between the low figure and the high one is greater than the entire toll of the First World War. It also struck in the middle of that war, which held first claim on the attention and the money, while censors kept anything that might weaken morale out of print and a disease that killed quietly indoors was easy to leave out of the official word.

The country is doing it again, and faster. The United States passed a million recorded COVID deaths in the spring of 2022, a toll roughly equal to the American dead of the Civil War and the Second World War combined, and what stood out at the time was how little national mourning rose to meet it, in a country where the dying had been a daily headline for two years.

That million was itself an undercount. A study published this spring in Science Advances, led by the Stanford epidemiologist Mathew Kiang, trained a machine-learning model on the death certificates from settings where testing was reliable and turned it on the ones where it was not. It found more than 155,000 American deaths in the first two pandemic years that were never recorded as COVID at all, about nineteen percent on top of the official count. The unrecorded dead were disproportionately Hispanic, Black, and Native American, more often people without a high-school education, in poorer counties and the rural South, and most of them died at home, where no one was testing. Kiang's explanation is the one worth carrying into everything that follows: death reporting in the United States is a fragmented, under-resourced system, and the surge ran straight over it. The country mislaid these dead before it could mourn them, because the count that would have named them was never finished.

Counting can also be interrupted by decision. For more than sixty years the Morbidity and Mortality Weekly Report, the Centers for Disease Control's weekly disease-surveillance bulletin, had appeared without a single missed week, through national holidays and through the days after the attacks of September 2001. In late January 2025 it did not appear, for the first time in that long run, halted by an order pausing external communications across the federal health agencies. It missed a second week before resuming in early February, and among the findings held back were updates on a spreading strain of bird flu. The reasons given were procedural and the interruption was brief, but the lesson sits underneath the particulars. A count is a decision remade every week, and when it lapses, even briefly, not knowing gets easier.

This is the thread the week hangs from. A society cannot keep what it never counted, and what goes uncounted is not always an accident: some numbers are never gathered because gathering them would be costly or politically uncomfortable. But counting is only the start. The 1918 pandemic is not lost to the record, where historians have reconstructed it in detail; what faded was the active remembering, the kind a society has to choose and renew, and mostly chose not to. Memory is work in both places, the counting and the keeping, and it can give way in either.

What is missing from a count is often the most telling part of it, and cybersecurity shows this plainly. The same failure runs at two scales: the evidence a single worker can carry from job to job, and what the field knows about itself as a whole. Pay data is a patchwork of self-reported surveys that disagree. Head-count estimates are blurred by the people who claim the title without doing the work and the people who do the work under another title. Time-to-hire by specialty, one of the measures a candidate or an employer would most want, has no trusted public baseline. A field knows about itself only what it troubles to count, and cyber counts its own workforce so little, and so indirectly, that the thing millions of careers turn on can be reached only through proxies and estimates, never measured directly.

Behind the missing numbers are people. The scale is nothing like a plague's, but a long stretch out of work can still cost a person their health insurance and, before long, their home. What the week ahead traces is how a field this hard to see came to be, and what the blind spot has cost the people inside it. The rest of this week calls that aftermath cybersecurity's long COVID.

The next essay goes back to the morning the offices closed, to a profession standing at the edge of its own quarantine carrying a decade of unexamined habits and, this time, a digital economy riding on it. The last great forgetting began the same way, with the catastrophe already in the room and a public record too weak to hold it in memory. We have been here before. We did not keep the notes.

Skill:Signal:Trust is the daily newsletter of Aramis, which assesses cybersecurity candidates against the NIST NICE Framework, an attempt to measure capability where the field has learned to settle for proxies.

Source notes

The title. Salvador Dali's painting The Persistence of Memory (1931), with its melting clocks, stands here for memory that warps rather than holds. "Pale Rider" is the title of Laura Spinney's history of the 1918 pandemic (below), and before that the fourth of the horsemen of Revelation 6:8, Death on a pale horse.

Laura Spinney, Pale Rider: The Spanish Flu of 1918 and How It Changed the World (2017), for the 1918 influenza as the deadliest pandemic of the twentieth century and for its survival in collective memory largely as a footnote to the First World War.

The 1918 death toll and its uncertainty. Modern estimates of the global dead range from 17.4 million (P. Spreeuwenberg et al., "Reassessing the Global Mortality Burden of the 1918 Influenza Pandemic," American Journal of Epidemiology 187(12), 2018, DOI 10.1093/aje/kwy191, which argues earlier figures were too high) to 50 to 100 million (Johnson and Mueller, 2002), with intermediate estimates such as Patterson and Pyle (1991) at about 30 million. Total deaths in the First World War are generally put at 15 to 22 million, so the span of the flu estimates alone exceeds the war's entire toll. That combatant governments suppressed reporting of the pandemic to protect morale is documented across the standard histories of the outbreak, Spinney's among them.

The one-million milestone: the United States recorded its millionth COVID-19 death in spring 2022. The comparison to the combined American military dead of the Civil War (roughly 620,000 to 750,000) and the Second World War (roughly 405,000) was widely drawn at the time and is approximate.

The undercount: Mathew V. Kiang et al., "Applying machine learning to identify unrecognized COVID-19 deaths recorded as other causes of death in the United States," Science Advances 12, eaef5697 (March 2026), DOI 10.1126/sciadv.aef5697. The study estimates 155,536 unrecognized COVID-19 deaths (95% uncertainty interval 150,062 to 161,112) from March 2020 through December 2021, about 19 percent more than officially recorded, occurring disproportionately among decedents without a high-school education; Hispanic, Black, and Native American decedents; poorer counties and the South; and at home. The "fragmented, under-resourced" characterization of US death reporting is the lead author's, reported alongside the study.

The MMWR interruption: the CDC's Morbidity and Mortality Weekly Report, published weekly without interruption for more than sixty years, did not appear on January 23, 2025, and again on January 30, halted by a pause on external communications across federal health agencies, then resumed on February 6, 2025; the held-back material included H5N1 avian-influenza updates. Reported by Healio, CNN, NBC News, and a February 2025 US Senate staff report, among others.

On the cybersecurity labor market's data gaps: reliable, direct figures for what cyber work pays, for the true size of the workforce, and for time-to-hire by specialty are largely unavailable. The field's roles span many industries and job titles, and its best-known workforce numbers are survey estimates rather than head counts, so the market is generally read through proxies and surveys rather than measured directly. This characterizes the absence of authoritative data; it is not a claim that no figures of any kind exist.