Everyone at your organization has a different role. From the maintenance staff to the CEO, the skills required to keep the gears of an organization’s bureaucracy running smoothly differ widely. Even though people vary in background and duties, security controls for workforce risk are often universally and indiscriminately applied. Policies govern appropriate use for everyone, all are subjected to the same security awareness training course, phishing simulation emails are sent to every address, and everyone’s traffic runs through the same set of network appliances and anomaly detectors. This one-size-fits all approach has its advantages. It is certainly easier to deploy in an organization, and provides a sort of universal, minimal set of mitigations.