Implementing strict regulations on cybersecurity measures may inadvertently create vulnerabilities by making systems predictable to attackers. We should consider whether a flexible, adaptive approach might be more effective in the face of evolving threats.