Why Security Prevention Alone Is Not Enough