Most security advice or guidelines are written as a one size fits all, but that does not mean it fits well. How do we know what to prioritize and can we avoid security busy work? In this talk we will discuss modeling for risk and how to identify where your true problems are and how you can understand what really is at stake. And no, your parents writing down their Netflix password is not as bad as you might think it is.