Security is not a product, but a process.