> In my experience, whenever this happens, whenever the user goes above and beyond to do such things, the security team should revisit their values rather than

> In my experience, whenever this happens, whenever the user goes above and beyond to do such things, the security team should revisit their values rather than the other way around. It may not be the value of the security team, but the values that are part of a cyber-insurance policy, or regulatory regime, and thus outside of what the security team are able to change. Perhaps the user, at times, does not understand the larger context, and the risks that he is exposing the organization to.