So implement those tighter security controls when they make sense. Don't force them on everyone when only a small fraction of cases are worthwhile.