Their concern is compliance, not security.