It should be clear by now that operating the way we have always operated is not a strategy for business survival. A lack of discipline in timely security-oriented decision making promotes the status quo and results in tragic events that could have been avoided or minimized. Being aware of threats, especially those that are rapidly emerging, has become more difficult in complex environments. Furthermore, the efficient application of resources has become more of a challenge as security leaders want to mitigate threats while not interfering with operational efficiencies and compromising business financial performance. A more structured approach to fact-based decision making and risk awareness is needed.