I’ve had clients who thought they needed an absurd level of security. (And I’m talking absurd even by my standards, and my code was developed by a bond company known for intense xenophobic paranoia, tempered only by desperate greed.) I’ve also had clients who thought they didn’t need any security at all, right up until something ate them. (That’s mostly a metaphor. My uneaten client stat is high.)