“How would anyone know that a security program is effective without an occurrence to test it? For instance, how do you show that the camera installed over the door acted as a deterrent to the person who was contemplating a violent act if the act did not occur? The answer is simple. You can’t.
That is one reason why budget justifications are challenging for security. Compounding the problem, is that security is a cost center and does not drive revenue. To top it off, security breaches are rare. It is easy for top executives to take security for granted, but complacency is a breeding ground for disaster.
…The statistical reality is that any organization, no matter size or type, will experience a security incident at some point. The more employees and the longer the organization exists, the greater the statistical probability of a security event. Embracing the need for a well thought-out security playbook can make the difference in obtaining resources once a security event occurs.”