“if your network boundaries are tight and your users are trained to avoid social engineering you will be better off in cost.”