If you have worked in security or just read articles on security for any length of time you will realize that all you are trying to do is provide risk avoidance. To this this you have to be good at assessing risk and then working to minimize it. I am constantly bombarded by sites discussing how we as humans are awful at risk assessment. Maybe this is what makes a good security professional, the ability to see through the false positives and find the real threat.