Risk versus security measures