Platform security is not what you think it is