Often, when I'm consulting with a client and a third-party service provider, I may have the need to bring up a security concern which should be considered, or eliminated, surrounding what the third-party service provider aims to implement. This can be met with a defense of "We have always done it this way and not had a problem yet." which drives me insane!