Paying for Security or Punishing It?