I often equate IT security to auto theft.

If you are trying to protect your car against kids wandering around a mall parking lot looking for a car to joyride in, then you just need to not be the least secure car (I just need to outrun you). They will just go for the lowest hanging fruit.

However, if your car is targeted by a professional car thief who is being paid to steal the specific model and color car you have, that is very difficult to defend against. Your adversary is well skilled, and has the time, resources and motivation to do what it takes to steal your car (You need to outrun the bear). This is a very different situation and very difficult to stop.