> If they came to believe they were?

That's what I don't get - security and compliance people are paranoid.

This is the kind of thing they shouldn't be requiring evidence to care about, given the rest of their job is about the "what-ifs". Just seems crazy to me.