This type of security is an improvement but doesn’t actually address all the possible risks. Say, if the capabilities you need to complete a useful, intended action match with those that could be used to perform a harmful, fraudulent action.