Opinion: Security policy in the age of compliance