Security is a process, not a product.