business projects have the advantage of potentially generating income, whereas IT security simply has “nothing bad happening” as the goal