Raising cost instead of promising impossibility
Framing security around attacker cost — the time, resources, and risk of detection an adversary has to spend to succeed — describes what most controls actually do more accurately than a claim of preventing an attack outright. An attacker with sufficient time, resources, and tolerance for detection risk can often eventually overcome any single control; what a good control changes is how much of each of those the attacker has to spend, and whether spending them is worth what they'd gain.
This reframing matters because it changes what a defender is actually trying to accomplish: not an unreachable standard of absolute prevention, but a deliberate, measurable increase in what an attack costs — in effort, in resources, in exposure to detection — relative to whatever the attacker stands to gain from succeeding.
Why this framing holds up better under scrutiny
A control described honestly as raising cost sets an expectation that survives a single counterexample — a sophisticated, well-resourced attacker eventually getting through doesn't contradict the claim, because the claim was never that they couldn't. A control implicitly promising an attack can't happen sets a much more fragile expectation, one that a single successful breach can seem to falsify entirely, even in cases where the control was doing genuinely valuable work up to that point.