Management must choose a cost-effective investment in security Keep in mind that costs aren't simply the price of security software but are the costs of slowing down the business due to increased red-tape.