Technology carries inherent risk, and human users can never be completely “secured.” Organizational leaders must dispel the notion that risk can be entirely eliminated. Risk can be mitigated by intelligently apportioning proven security defenses.
Recognizing inevitable degrees of risk instead of levels of security enables a more holistic approach to security planning. Most cyberattacks target the weakest links in a network. Hardening security in those areas forces cybercriminals to move on to easier targets. With this in mind, using your limited security budget to upgrade “good enough” firewalls makes no sense if your weakest links are IoT devices and inadequate remote worker security.