Half-full or half-empty?

Reed College CTO (and all-around good guy) Marty Ringle is leading a current issues roundtable session at Educause a week from today. The abstract for the session titled "The Rising Cost of Distractions" reads:

Already stressed IT budgets face the rising costs of virus and worm defenses, increased network security, spam control, copyright infringement, privacy regulations, and other requirements. A survey of liberal arts colleges indicates that such items may be consuming 10-15% of central IT budgets. This roundtable shares ways colleges are dealing with these "overhead" costs along with financial, administrative, and user relations strategies.

I can't make my mind up about this...Given what we've been through in the last year and a half, should I be discouraged or relieved that our organizations are spending 10-15% of our budgets on security, legal regulations, and other nuissances? On the one hand, these expenditures contribute absolutely nothing to the core mission of a college other than letting it get back to do what it was trying to do. On the other hand, would we be deceiving ourselves to think that we didn't have to make such expenditures.

In otherwords, are we just paying the piper now for not having made better investments in preparation and prevention?