I don't think I agree. Complexity is the enemy of security, but it's rarely the primary focus. Not least because you often can't do anything about it, and you

I don't think I agree. Complexity is the enemy of security, but it's rarely the primary focus. Not least because you often can't do anything about it, and you frequently have to add complexity to solve infosec issues. If it's ultimately anything, it's the management of risk.