Effective security requires realistic risk assessment, not fear-driven responses.