To be frank, if I could choose which of those to achieve, and it would be perfectly achieved, I'd choose actual security, but the reality is that it's impossibl

To be frank, if I could choose which of those to achieve, and it would be perfectly achieved, I'd choose actual security, but the reality is that it's impossible to actually meet most SLAs. I have met exactly 0 infosec folks who can honestly claim their company meets patching SLAs, much less vuln SLAs in general. And as the saying goes, if one employee is failing, that's a personnel issue. If many employees are failing, that's a management issue. The entities in charge of security are always the boardroom Executives of the company, ultimately, because they set the strategic priorities and silo budgets. And their main goal is never actually security.