security, it's a process not an outcome