Why is it that in some or many cases, security professionals are not engaged at the start of new initiatives either internally by their own organisations or via clients? It is because we frighten people? Are we too stealthy? Is it because they don't want to trouble us? Don't know how to engage with us professionally? Don't want to embarrass themselves by asking the wrong questions? Don't want to spend money on security? What drives them to these momentary moments of insanity, where someone makes a decision at the start of an engagement not to get security professionals involved? Which normally results in a high intensity catch up and help them out of a rut or in many cases save their bacon literally? Security is a business (business, people and technology) problem, adding additional technology, which does not integrate with the organisational security framework and how it operates, just exasperates the situation as we all know. Answers and points of view would be appreciated.
