We have to approach this as a question of how, not if. When we do that, we can change computer security.