There is no Security consulting intervention that does not require organisational transformation. It is not only unsatisfactory, but definitely damaging to think otherwise. Security problems appear precisely then when the technology pretends to “automate” processes and safeguards that never existed or are weak in the organisation. Nevertheless the mirage of technology is still presented as the “tooling” business needs to “increase” security. The truth is that a techno-centric approach creates more Security problems in its wake.