Watch this video on YouTube
What is the optimal course of action when encountering an organization with budget limitations that lacks critical security capabilities?