Yup, agreed. My point is that I find it easier to talk a defeatist into a somewhat proactive security practitioner (everything is hackable but the point is to d

Yup, agreed. My point is that I find it easier to talk a defeatist into a somewhat proactive security practitioner (everything is hackable but the point is to deter, delay, and mitigate, not outright stop all attacks), but it's a lot harder to talk a security absolutist into backing down because their initiatives are a net negative. Also, the nuanced posture can look like the defeatist attitude if you don't pay attention to the details —and, on the flip side, you need to pay attention to those same details to tell a proactive attitude from security theatre.