How Much Security Is Enough? Practitioners Weigh In