Is there a point of diminishing returns on experience for security? Two might be enough.