A structural point: security requires continuous investment; it's an operating expense, not a one-time cost.