As with all security audits, most findings are a balance between risk and usability.