I think the fear response comes from people who don't assign probabilities to things, so they just see that everything is a risk (leading to disorders like OCD

I think the fear response comes from people who don't assign probabilities to things, so they just see that everything is a risk (leading to disorders like OCD in the extreme). And at work you can see people focusing on mitigating the wrong security issues. There's a sort of maslow's heirarchy of security that needs to happen, and some people noodle way too hard on memory bit flipping attacks and not on just making sure you can't ssh into something with a guessable root password. Of course its more intellectually challenging to think about all the ways that the NSA could break into Google, but if you don't work at Google its all the boring shit you need to make sure you have in order.