To make a convincing business case for security investment , data on the risks and costs of security incidents are required; but reliable data are hard to find.
a. True
b. False