This deep dive expands on the Loop Asia conversation with Joseph Yap, founder of Otonata.

Joseph Yap didn't come to cybersecurity through cybersecurity — he came through supply chain and operations, years of lean methodology work in warehouses, where the discipline is about knowing what you have, keeping it in working order, and not letting entropy win by default. Auditing home networks through his firm Otonata, he reached for the framework he already knew: 5S, built around five Japanese terms that don't translate cleanly into English. The two he leans on hardest translate as sort and shine — mapped onto a home network, they describe almost exactly what's missing from how most people manage their digital lives.

Sort depends on a step most households never take: knowing what you have. Joseph's opening move on any audit is an asset register — a full list of every device on the network. It sounds basic. It almost never exists. "In this 24-7 news cycle... we don't do that at home. We don't do that at work." Sort means removing what shouldn't be there — like the media player bought a decade ago that quietly became redundant once the smart TV could stream the same services, except nobody unplugged it or checked whether it still got updates. It's still on the network. Still a way in.

Shine is the hygiene layer that follows: strong, unique passwords, current firmware, multi-factor authentication where supported. It's the least glamorous part of security, and the part that fails most — not because people don't know it matters, but because nobody's watching for the moment it lapses. A case from last year: TP-Link modems, high-end and trusted when sold. A researcher found a serious vulnerability and disclosed it; two weeks later, 66,000 of these devices were still live and exposed on the open internet. Shine is a habit, not an event.

Devices slip out of hygiene unnoticed, because nothing about them visibly changes. Joseph's clearest illustration: the first full audit he ran on someone else's house — a friend, two IKEA bags of scanning gear. The Wi-Fi password took three seconds to crack. The smart TV, cutting-edge when bought, was by then old enough for remote code execution. And an irrigation controller, installed for easy remote access, had a permanent, open backdoor to the internet — "easy to access" and "insecure" had quietly become the same thing. "Each of these things were either secure or made sense to be insecure," Joseph says, "at the point they were installed." Nothing about the devices failed; the world around them moved and they didn't.

That's what the fifth S — sustain — is about: firmware keeps shipping updates, vulnerabilities keep getting disclosed, and devices keep aging toward the point manufacturers stop supporting them — the fate that met Windows 3.1, and that's catching up to the Windows XP machines Joseph says still quietly run elevators and ATMs, kept alive by retired programmers pulled back in because nobody else knows the systems. A one-time audit doesn't fix any of that. Joseph's own answer started low-tech — an Obsidian note, a six-month reminder — before he built it into the service he now runs for clients: an automatic asset register, a vulnerability scan, and a report weighted to risk.

None of this requires becoming a security expert — that's the point of borrowing from Lean, which turns an overwhelming problem into a short list of repeatable actions: write down what you have, get rid of what you don't need, fix the passwords and update the firmware on what's left, and do it again in six months. Not a technical fix. A habit — one Joseph's audits suggest almost nobody has, until something in the house starts acting strange.