As an information security analyst for an organization that deals with highly valuable info assets, I agree. The comment you replied to sounded like how employees argue for less security. They don't understand the scope or environment of information security.
95% isn't nearly secure enough. You're actually looking for the one malicious agent among thousands. If you conduct contracting bids, you have to realize that at any moment your employees can be offered incentive to leak, and their leaks will cost millions of dollars.
So when we apply our strict need to know policies and data transfer tracking, it's not about trusting individual employees. It's about finding a needle in a haystack.
