>The BEST result you can get from spending on security is...nothing bad happens.

That's crap =]. A secret about security compliance (aka defense in depth) is that it actually reduces your technical debt, doesn't increase it. That's the best result in the world, low technical debt!