Precisely. Some folks over-estimate the security risks and under-estimate the business risks. Typically, the biggest risk to any organisation is going bankrupt,

Precisely. Some folks over-estimate the security risks and under-estimate the business risks. Typically, the biggest risk to any organisation is going bankrupt, and doing "too much security" can make that more likely.