Getting in the right mindset for security transformations