When your biggest security risk has never signed a contract