I maintain the major issue is the lack of budget granted by boards, that is until some thing happens. All too often there is a reactive response. Security must be proactive