Principal Microsoft Researcher Cormac Herley argues users’ rejection of security procedures is often entirely rational as the expected benefits of following security advice are often outweighed by the expected costs.