Most security concepts are written, signed off, and then quietly stall. The gap is not the plan but the phase that turns it into practice, the implementation work nobody hires for. On why it is overlooked, why in protection it is a liability, and the role that belongs before the permanent one.