Why security compliance is not bullshit