What’s preventing organizations from making pragmatic security decisions?

Human beings are poor judges of risk. For example, we perceive the risk of air travel to be higher than it actually is after a fatal aviation-related accident happens.