Interesting this shows up here. I saw an article covering this study this morning and thought "yeah, that's how IT security works" (or does not work). Everyone

Interesting this shows up here. I saw an article covering this study this morning and thought "yeah, that's how IT security works" (or does not work). Everyone agrees if you say "complexity is bad for security". But somehow it's still incredibly unpopular in practice. Most commercial security products are all about adding more stuff, and they don't seem to go bankrupt.