How much security is enough?