The Security Risk Advisors co-founder has spent years asking whether defenses work. His other enduring question is who gets the chance to build them.
