Which three risks should the security director be concerned about?