The best security organizations I've worked with understand...

The best security organizations I've worked with understand and attempt to quantify the risk-management decisions they make on an ongoing basis.