> So where does it end? It doesn't (can't) ever end because security is a process, not something you achieve and are done. With ~inifite budget, one could ach

> So where does it end? It doesn't (can't) ever end because security is a process, not something you achieve and are done. With ~inifite budget, one could achieve perfect security (but only for a clearly scoped threat model) for an instant, but both the infrastructure and the attackers move on, things constantly change, so it's not perfect anymore. And of course infinite budgets don't exist.