It is a sad fact that companies are willing to spend much more money after the fact and a breech has occurred, than before it to make them more secure.
Our jobs a CISSP's should be to be able to clearly articulate the damage and cost of a breech and fight for funding, because like the saying goes "You can pay me now or pay me later."
