everything was about avoiding a breach, stopping it happening. Now there's a minimise the damage, anticipate it, accept it. Most organisations, I don't think, are trying to entirely prevent a a breach. They're not entirely trying to prevent a breach.

The security function was this tiny little thing hidden somewhere in IT. Buying security products was like buying air conditioning and toilets. You know, it just wasn't important to the organisation. It was just stuff you had to buy to run the place.