Which two risks should the security director be concerned about?