Not every security recommendation should be implemented

Not every security recommendation should be implemented. Let me tell you which ones shouldn't.

If your security vendor recommends controls that would break core business processes or make it impossible for employees to do their jobs, they're optimizing for security theatre, not actual protection. Security that prevents business from operating isn't security, it's sabotage with good intentions.

If the recommendation costs more to implement than the asset you're protecting is worth, you're not managing risk, you're over-engineering. A $200K security control to protect a $50K system isn't risk management, it's fear-based spending.

If implementing the recommendation would create so much friction that employees will just find workarounds, you're not increasing security, you're creating shadow IT and false confidence. Security that can't be followed won't be followed.

But here's when security recommendations absolutely should be implemented: When the risk exposure exceeds your appetite and the control is proportional. When regulatory compliance requires it and non-compliance has material consequences. When the recommendation actually reduces risk without breaking the business.

The difference between $20M to $100M companies with effective security and those with expensive security theatre? They ask: "Does this control actually reduce our risk, or does it just make us feel safer?" Effective security is about managing real risk, not implementing every recommendation on a vendor's checklist.

I've seen companies spend six figures implementing security controls that drove core business processes underground into spreadsheets and personal email, making them less secure than before. Not every security recommendation makes you safer. Some just make you slower and create new vulnerabilities.

What security recommendation did you push back on, and were you right?