“Security is about making sure the people who aren’t authorised to have data don’t get it."