Security isn't something that you buy, it's something you do.