Business lives by risk. But the concept of 'acceptable risk' is an oxymoron to many security professionals.