Many businesses are waking up to the fact that they’ve spent millions of dollars on preventative measures and they still lose. The difference between digital risk and many of the other risk types is the consequences can be tough to identify. Risk mitigation does not mean risk elimination. Winning has to be defined using the words I used to explain risk in my first book: This definition does not eliminate intrusions from the enterprise. It does leave an uncomfortable amount of interpretation for the “acceptable level” aspect.”]
Source: https://taosecurity.blogspot.com/2007/12/does-failure-sell.html