@matt @lennyzeltser My own experience from the end user perspective is that often cybersecurity policy changes are formulated without taking into account many user use cases. As a result, they end up making it impossible for many users to accomplish their job functions while obeying the rules. People still need to do their job, so they end up developing workaround that are less secure that the situation before the new rules. The end result is worse security and a loss of legitimacy for security rules in the eyes or end users.