Security is not attained, it is practiced. It's not a state, it's a process.

Processes have rituals and tools. To improve security, we have to look for better ways of working. Of course no single tool is going to "fix" security. But some bring improvements which are so obvious that they cannot be disregarded.