To do so, they had responded to these risks by reorienting their security programs from relatively low-profile operations focused primarily on mainframe security to visible, integral components of their organizations' business operations.