When 'Secure Enough' Isn't Enough