User group defines security needs