Sometimes when you plan for a security event, it would be expected that the thing you’re doing will be making some outcome (something bad probably) impossible. One way to look at this is security is often in the business of preventing things from happening, such as making data exfiltration impossible. A lot of security projects forget that if the cost of what you’re doing is greater than the cost of the thing you’re trying to protect, you’re wasting resources.