If you say "yes" rather than "no", you become involved in the process of implementing the system and can provide security fixes and mitigations. If you say "no"

If you say "yes" rather than "no", you become involved in the process of implementing the system and can provide security fixes and mitigations. If you say "no" they they probably do it anyway, stick it in Digital Ocean, and never tell you about it. It stops getting patched when they leave the company. Years later, someone kicks the door down and finds it littered with your IP. Of course they were wrong to go through unofficial channels, but as a security professional, you don't plan for things to happen as you expect. You plan for things to go wrong, and you plan so they go wrong less. > Must be nice to have a high enough position in life to ignore security protocols at whim. If I did that I would be fired. Ivory towers take a stain too easily, so I only summer there. The rest of the year I stay on the ground with you commoners.