For all of the change that occurs in the industry, there remains one immutable consideration that every IT security manager must deal with: the justification of security costs.