Security’s next balancing act: retention, margins and modernisation