“Security is not a product, it's a process.” – Bruce Schneier