Security is a process, not a product.

Bruce Schneier, “The Process of Security”