Having worked under many security policies, they fall into three categories 1. Basically a startup with no security whatsoever 2. Security prevents you from d

Having worked under many security policies, they fall into three categories 1. Basically a startup with no security whatsoever 2. Security prevents you from doing your job, so people have no choice but to actively work around it 3. Security integrates seamlessly with developers workflow 1 and 2 were the most common. 3 was rarest. If you want good security, you also have to care enough about UX so people don't work around the security. The answer is that bad security gets in the way of peoples jobs, and people have no choice but to work around it. Good security is effortless and cares about the UX. Frankly, that's hard, so many companies don't do it very well.