Why a security plugin is not enough.