The security industry is now a $160B+ industry. So how are we doing? Many CISOs are feeling the pressure of selecting just the right products from a field of thousands of vendors and even more providers. But where does the real risk lie? In what you have detected or what you haven't? Once a company has put millions of dollars into improving cyber security but are still getting compromised, then what? One CISO's perspective on how to look at the overarching issues we face in trying to detect and stop cyber attacks before they start.