What is the fundamental difference between a security event and a security incident, and how do you define the transition threshold?
