Good encryption is sold as a way to prevent eavesdropping. A good firewall is a way to prevent network attacks. PKI is sold as trust management, so you can avoid mistakenly trusting people you really don't. And so on. This type of thinking is completely backward.
Security is old, older than computers.
And the old-guard security industry thinks of countermeasures not as ways to counter threats, but as ways to avoid risk. This distinction is enormous. Security processes are how you avoid risk. Just as businesses use the processes of double-entry bookkeeping, internal audits, and external audits to secure their financials, businesses need to use a series of security processes to protect their networks. They can help mitigate the risks.