> I've worked for companies, where security issues weren't reported by power users because they themselves had to exploit those vulnerabilities to be able to do

> I've worked for companies, where security issues weren't reported by power users because they themselves had to exploit those vulnerabilities to be able to do their job Yes, this is a well known effect of security policies: when you add too much friction to people's lives they will find ways to work around it. Any competent security policy will have to take this into account.