A few years ago, a friend stayed at my place during Ruxcon and gave me a bottle of rum called Inner Circle as a thank-you. I liked the name. To be fair, at 75.9%, I am surprised I still remember it.

But over the years, security has started to feel a bit like that.

At Unprompted Australia two weeks ago, I ran into at least two people I had originally met in Prague. Different conference, different country, almost the other side of the world, and somehow the same people.

The year before, at an OWASP meetup in Krakow, I met people who were working with one of my former coworkers from Fitbit in San Francisco. Let's call him Spiderboy. #innerjoke. You travel halfway across the world, walk into a meetup in Poland, start talking to someone, and somehow the conversation gets back to a guy you used to work with in SF.

I've also seen people meet simply because one of them decided to wear a PentesterLab T-shirt at a BSides in Ireland. They didn't know each other, but the shirt gave them a reason to start talking, and suddenly two people I knew independently knew each other too.

This keeps happening.

Security is a huge industry, with conferences everywhere, thousands of companies, countless specialties, and more people joining every year. And yet somehow, everyone seems to know everyone. Maybe not directly, but usually there are only one or two people in between.

The longer I stay in this industry, the more it feels like one enormous, messy graph.

You notice it even more when people are hiring. I've lost count of the number of times someone has asked me, off the record, "I saw this person worked at X. You worked there too. What do you think of them?"

Sometimes I know them. Sometimes I know someone who knows them. And I'm sure the same conversations have happened about me.

That's the thing about a small industry hiding inside a big one: your reputation travels further than you do.

People remember who helped them and who was generous with their time, but they also remember the people they never want to work with again. Because everyone seems to be connected somehow, those stories travel too.

So I think the lesson is pretty simple: security is a big industry, but the inner circle is surprisingly small, and your reputation will probably get there before you do.

TL;DR: don't be a jerk.

And drink rum. Because that's what pirates do.