Why physical security assessments are so often overlooked