Easing the friction between IT and security