One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
NIST now recommends watching for suspicious activity and only force rotation when there’s risk of compromise
Tell me, can your users identify suspicious activity cuz mine sure as hell can’t.
That’s why password leak detection services exists
(And a rare few of them yes)