users don’t care about security until it goes wrong. then they will be angry.

security is a hidden requirement.