Great analogy re. appsec.

Risk is never zero and achieving it prevents everything.