Given how besieged organizations must feel today by both the growth in the incidence of information security breaches and the types of information security breach techniques that result in those breaches, the knee-jerk reaction is to throw money at perceived problems -- or at breaches that have already occurred -- in the hopes that this will constitute effective risk management. A more level-headed approach is to balance information security spending against actual risk.