Security, safety and resilience are not things we can buy component by component. They must be designed, assured and governed as system properties. Anything less is policy illusion.