Checking in on the industry between calls, found this news item from yesterday, related to Microsoft's security “tour” program they running right now:

Discussing how some have tried to position security efforts as potentially beneficial to the bottom line, Microsoft chief security officer Scott Charney admitted he was cynical. "Security is a cost center. If there were no attacks, no one would bother," he told a few hundred IT professionals at the event.

So true. Sure, beefing up security is important, required, beneficial and prudent in this day and age. But the fact of the manner is if there was no pain, we would not be spending big bucks in this area.

It's also worth noting that - in reality - a relatively small amount of preventative planning in this area today can save huge numbers of reactive dollars tomorrow and after. Security budgets are important. They may look expensive to some, but when you consider the potential costs on not preventing problems, the downside could be very costly, indeed.