On stupid regulations: everyone knows about security theater, eg 90 day password rotation rules. Users then pick weaker passwords. It took NIST 14 years to reverse that stupid rule.
This is the cost of incompetent regulators, or those that dismiss psychological effects of their regulations.
And we’re seeing this today with what “AI safety experts” (derogatory) are doing. We’ll get folks using shadow IT/AI and make everyone more insecure because of stupid regulation.
It is completely predictable and avoidable, but they have their own agendas, and it’s not about end user safety.