Who’s Driving the Bus: Compliance or Security?