Security should not be treated as a wall around innovation. In schools and other organizations, the better model is protection with flexibility: enough control to reduce risk, but not so much that people cannot do meaningful work.
That balance matters because security touches everything. It is not just the concern of a dedicated security team. It affects software decisions, classroom tools, workflows, trust, and the day-to-day choices people make about what they can try and what they can adopt.
Security should enable work, not block it
One of the clearest signs of mature security is that people can still do their jobs. When safeguards become so restrictive that staff cannot innovate, test new tools, or move quickly, security has crossed a line. It is no longer protecting the organization; it is slowing it down.
The stronger approach is process-based, not prohibition-based. That means allowing new tools or ideas to be tried, reviewed, and evaluated before full adoption. Not everything has to be supported immediately, but there should be a path for safe experimentation.
- Allow people to try new things.
- Set a process for review and adoption.
- Distinguish between trying something and fully supporting it.
- Protect the organization without shutting down innovation.
Good security respects human reality
Security is not only technical. It has human consequences. People need room to make choices, take reasonable risks, and learn from mistakes. When every decision is heavily policed, people do not feel safer. They often feel watched, constrained, or afraid to act.
That is why the right question is not, “How do we remove all risk?” The right question is, “How do we create a place where people can take appropriate risks without being punished for trying?”
Natural consequences are part of life. Punitive overreach is something else entirely. A mature culture understands the difference.
Freedom and security have to be balanced
There is a real tradeoff between control and freedom. More visible security can create the appearance of safety, but it can also create anxiety and reduce openness. The point is not to maximize control. The point is to preserve freedom while using safeguards where they genuinely help.
That means accepting some limits where they make sense, such as strong passwords or a password manager, while resisting the urge to over-control every part of the environment. The goal is confidence, not fear.
AI raises the stakes
AI is changing the security conversation. There is already a push to create frameworks for AI governance, and that work matters. Bad actors can use AI to make scams and fraud more sophisticated, which increases the need for vigilance and better safeguards.
At the same time, the answer is not to shut everything down. The better response is careful, informed adoption. In education especially, that means choosing tools with external validation and giving honest feedback to vendors when products do not work as promised.
What educators and leaders should take from this
For schools and education-adjacent organizations, the takeaway is straightforward: security should protect the mission, not suffocate it. Build systems that are safe enough to trust, flexible enough to use, and open enough to support learning.
That requires a mature mindset:
- Use security to reduce real harm.
- Preserve room for experimentation.
- Adopt safeguards that support, rather than control, the work.
- Evaluate AI tools carefully and demand accountability.
- Protect trust, because trust is what lets people plan, invest, and move forward.
In practice, the healthiest systems are not the most locked down. They are the ones where people can work, learn, and take reasonable risks without losing confidence in the environment around them.
Frequently Asked Questions
What is the best balance between security and innovation?
Use security to reduce real risk without making work impossible. People should be able to try new things through a clear process, even if not everything is fully supported.
Why can too much security be a problem?
When security becomes overly restrictive, it can prevent people from innovating or doing their jobs well. It can also make people feel controlled instead of protected.
How should organizations think about AI and security?
Organizations should be cautious, use tools with external validation, and give honest feedback to vendors. AI governance is becoming more important as bad actors use AI in scams and fraud.
What is the role of trust in security?
Trust is essential. People need to feel that systems are safe enough to rely on, because losing trust in basic systems like banking or school tools creates bigger problems.
For more context, listen to the original episode of Cybertraps Podcast: INCH360 2025: Grant Erickson.