Depends, but usually the problem is that it is difficult to properly assess the probability of a successful attack and to get decision makers to believe that number.