So, aren't you sick of "security is like insurance", "security is like other IT investments", "security is like police work", etc? Here is one that will make you laugh - and think - at the same time: "Security is Like Dentistry"
Why? Read the post, but here are some highlights:
"* It’s more painful than the providers ever tell you.
* If you make decisions based only on financial Return On Investment you’ll really screw things up
* No matter how many times you strap someone to a chair, shine a light in their face, and poke them with sharp objects until they bleed you can’t make them any smarter."