Safety-critical industries have spent decades building mature practices for safety cases — structured arguments, backed by evidence, that a system is acceptably safe. Security has its own mature practices too.