"Just as our bodies prefer not to expend energy where it is not neccesary, our bosses prefer not to spend money where it is not necessary."
How true this is! And in security, in a lot of cases it's not deemed necessary until something bad happens. This is just a fact of life. If you have a culture where, say, email security isn't taken seriously, you have very little chance of changing that without some hard evidence (i.e. a breach). You can talk yourself blue in the face, but until the real risk decision-makers feel it in their bones, no money will get spent.
Commenting by HaloScan
