Each security solution is to be efficient, justified and rational, which is only possible when founded on realistic conclusions on the actual threats, vulnerability, probability of damaging events and their possible damaging effects. We cannot locate these on the basis of a superficial view, interview or intuition, but by using efficient tools and conducting a comprehensive risk assessment.