> If they came to believe they were? That's what I don't get - security and compliance people are paranoid. This is the kind of thing they shouldn't be requir

> If they came to believe they were? That's what I don't get - security and compliance people are paranoid. This is the kind of thing they shouldn't be requiring evidence to care about, given the rest of their job is about the "what-ifs". Just seems crazy to me.