Here’s a question that makes security people twitch: can you have too much security?
The instinctive answer is no. More locks, more scanning, more approvals, more MFA prompts — surely all upside? Anyone arguing for less sounds like they’re arguing for negligence, and nobody wants to be the person who said “eh, that control seemed excessive” in the post-incident review.
But the instinct is wrong, and it’s wrong in the same way that “more architecture is better” is wrong. Security isn’t a virtue you accumulate. It’s a property you buy, with real money and real friction, and like anything you buy it has a point past which the next unit costs more than it’s worth.
The costs nobody puts on the slide
Security’s benefits are easy to name — fewer breaches, less data loss, sleeping at night. The costs are quieter, which is exactly why they get ignored until they’re enormous.
- Friction tax. Every approval gate, every extra auth step, every “raise a ticket to get access” adds delay to everything, forever. Individually trivial; in aggregate, a permanent drag on how fast the organisation can do anything at all.
- Alert fatigue. Turn on every detection rule and you don’t get more security, you get more noise. A team drowning in low-signal alerts stops reading them — and the one that mattered scrolls off the top with the other four hundred. Past a point, more monitoring makes you less likely to notice the real thing.
- The workaround. This is the big one. A control painful enough that people can’t do their jobs doesn’t get obeyed — it gets bypassed. The shared password in the spreadsheet. The personal laptop that skips the locked-down build. The prod access that’s technically forbidden so everyone uses the one service account that still works. Over-tighten and you don’t remove the risk; you drive it underground where you can’t see it. You’ve made the system look more secure and be less so.
That last one is the trap. Security theatre isn’t just the harmless pantomime of taking your shoes off at the airport. Its real damage is that it consumes the budget and goodwill you needed for the controls that actually work, and it manufactures the very shadow behaviour it was meant to prevent.
The goal was never “maximum”
The reason “how much?” feels like a taboo question is that we’ve framed security as a moral scale — more is safer, safer is better, therefore more is better. But that’s not how any other engineering property works, and security isn’t special.
You wouldn’t ask for “maximum performance” without asking what it costs, or “maximum reliability” regardless of price — you’d ask what’s appropriate for this system, this data, this threat. A marketing brochure site and a payments ledger do not warrant the same controls, and pretending they do just means you’ve over-spent on one and, almost certainly, under-thought the other. Uniform security is a sign that nobody did the thinking.
As with everything else on this blog, it comes back to what you’re optimising for. The honest target isn’t the most security you can bolt on. It’s the right security for the value of what you’re protecting and the threats that are actually plausible against it — bought at a friction cost the organisation can absorb without routing around you.
”Appropriate” is doing a lot of work in that sentence
Which is the fair objection: appropriate is easy to say and hard to pin down. It’s the security equivalent of “it depends” — true, and useless if you stop there.
So don’t stop there. The whole point of the DevSecOps argument — security as a continuous, owned discipline rather than a gate — only pays off if you can decide which controls earn their place in that loop and which are just ceremony. “Everyone’s job” without a way to prioritise is just everyone’s anxiety.
The good news is that the people who do this for a living worked out a way to put actual numbers on it decades ago — a way to say, of a specific risk, whether it’s cheaper to fix it, to hand it to someone else, or to look it in the eye and decide to live with it. That’s the next post, and it’s the one that turns “appropriate” from a shrug into a calculation.
Because the mature version of security isn’t the fortress. It’s knowing exactly which doors are worth locking, and being able to show your working on the ones you left open on purpose.