Security is always excessive until it's not enough.
The performance standard must be Zero Defects. Not 'that's close enough'.
Psychology must be based on observable phenomena, not abstractions.