Today's state-of-the-art in computer and software security is dismal. The main reason for this is that most companies do not have a deep enough understanding of the serious technical risks that exist to make intelligent decisions about reducing those risks. For the most part, companies simply do not have qualified personnel to aid them in making appropriate decisions.