"Security is not a product, but a process."

Bruce Schneier