Comment by amelius

I think the main problem is that most organizations put security at the end of the budget list.