Why is "absolute security" considered impossible — and what does that imply for security work?

Perfect security is neither achievable nor affordable, so security is always a risk/cost trade-off, never a finished state.

"Security" (Sicherheit) is defined as a state of being protected from danger or harm — but in practice you can always imagine one more attack, one more failure mode. Defending against every conceivable threat would cost infinitely more than the assets are worth.

The consequence: security decisions are economic. You spend protection effort up to (and not beyond) the value of what you're protecting and the risk it faces. This is why risk management, not "lock everything down," is the core discipline.

Tip: A useful mantra — "Security is a process, not a product." (Bruce Schneier). There's no box you can buy that makes you "secure."