Scaling up from personal defense to societal-scale security considerations, it's useful to think of this as a battle with four fronts: code (what is technically im/possible?), law (what is il/legal?), normals (what is socially un/acceptable?) and markets (what is un/profitable?). This framework was first raised a quarter-century ago, in Larry Lessig's *Code and Other Laws of Cyberspace*:
https://commons.wikimedia.org/wiki/File:Code_And_Other_Laws_of_Cyberspace_Version_2_0.pdf
11/