Information Security: getting people to classify data properly. Everything ends up as the default classification or set to public so they can send privileged da

Information Security: getting people to classify data properly. Everything ends up as the default classification or set to public so they can send privileged data over email. Also, having some agreement on code scanning. Every time security settles on a code scanning tool, engineering gets a million findings. This results in arguing about whether potential risks are actually vulnerabilities rather than improving security.