Security is a cost/benefit decision, not a binary one. More security costs more. Putting the drivers licenses and bank details of employees in the same database

Security is a cost/benefit decision, not a binary one. More security costs more. Putting the drivers licenses and bank details of employees in the same database as the credit cards and names of customers is cheaper than putting them on separate databases. Putting them on the Internet is cheaper than having a separate network. Turning off your logs "when you don't need them" is cheaper than leaving them on all the time. If anyone says "total security is impossible" you just say: So fucking what? That's not an excuse for spending as little on security as possible, and you know someone isn't serious about security if they avoid admitting they are responsible for the security in the first place.