Following best-practice security policies may actually be making your defences weaker due to the amount of time it takes to onboard new services