Security is a stance not a feature. Being caught vulnerable and on the back-foot can be /really/ hard to recover from. Do risk-based security, and be realistic about remote risks. It sounds like there are already concerns about identified risks.