Nearly a decade ago Bruce Schneier wrote Security is a process, not a product . His statement helped us advance as a profession, but with the benefit of hindsight, we can see he s only half right. Security isn t about technology. Security is about outcomes, and our perceptions, beliefs and assurance about those outcomes. For us to mature as a discipline and as part of the organizations we support, we must go from talking about what might happen to what does happen.
Source: https://threatpost.com/security-about-outcomes-not-about-process-041309/72507/