In reply to Donn Parker.

"hat is because information security, threats, potential perpetrators, and vulnerabilities are unbounded, open-ended, and changing."

Verizon 2014 Kill-Chain/Attack model analysis says "hi." Low variance in actual attack patterns, a relatively simple number of attack patterns. Attackers may be "unbounded" or "open-ended" but they don't change that much.