Someone sent me a quote card the other day. You’ve probably seen it.

“Albert Einstein said if he had an hour to solve a problem, he’d spend 55 minutes thinking about the problem itself, and 5 minutes on the solution.”

I liked it. So I checked it.

Einstein never said it. There’s no letter, no interview, no paper — nothing. It’s internet folklore, the kind that gets stapled onto a famous dead genius because “Einstein said it” sells better than “some guy on LinkedIn said it.” Made up, plain and simple.

Here’s the thing, though. The quote being fake doesn’t make the idea wrong.

I’ve spent more than 30 years in this (information security) industry watching smart people solve the wrong problem, fast, with total confidence. Incident response is the clearest example I’ve got. Nobody calls me because they can’t patch a vulnerability. They call me because they don’t yet know what actually happened, what’s actually exposed, and what actually matters. The patch is easy. The 5 minutes. Figuring out what’s really broken — that’s the 55.

Same thing happens in board rooms. A CEO asks for “a security program.” That’s a symptom, not a problem. The real problem is usually something nobody’s said out loud yet — no accountability structure, no idea what “acceptable risk” means to them, a CISO who reports to someone with zero incentive to fund anything. You can build a beautiful program on top of that mess. It won’t fix anything. You solved a problem. Just not the one that mattered.

Here’s how you test it. Before you touch a solution, write down the problem in one sentence. Then ask: if I fixed exactly this, would the actual pain go away? If the honest answer is “no, but it would look like progress,” you don’t have the real problem yet. Keep asking why until the sentence changes. “Not enough MFA” becomes “nobody owns the decision to enforce it.” That’s a different problem. It needs a different fix. Everything after you find that sentence is easy.

Most of what looks like “the hard part” is really just impatience. We want the fix. We want the ticket closed, the meeting over, the box checked. Sitting inside an ambiguous, uncomfortable, not-yet-defined problem feels unproductive. It isn’t. It’s the only part of the work that actually determines whether the rest of it means anything.

So no, Einstein didn’t say it. But somebody should have.

Next time something feels hard, stop reaching for the fix. Write the sentence. Run the test. If you can’t tell me what problem you’re actually solving, you’re not doing the work. You’re just performing it.